From: abostick@netcom.com (Alan Bostick)
Date: Sat, 13 Jan 96 09:35:42 PST
To: shamrock@netcom.com
Subject: Digital postage and remailer abuse (was Re: Novel use of Usenet and remailers to mailbomb from luzskru@cpcnet.com)
In-Reply-To: <v02120d02ad1ce02500bc@[192.0.2.1]>
Message-ID: <sI+9w8m9LA9Q085yn@netcom.com>
MIME-Version: 1.0
Content-Type: text/plain


-----BEGIN PGP SIGNED MESSAGE-----

In article <v02120d02ad1ce02500bc@[192.0.2.1]>,
shamrock@netcom.com (Lucky Green) wrote:

> I am not sure that postage would solve this problem. The geeks would
> individually pay for it. Still, nominal postage would solve a lot of the
> problems that plague remailnet.

Maybe I'm misunderstanding how using digital postage with remailers would
work.  I was assuming that the postage stamp would be included *inside*
the encrypted envelope, that what the remailer would do on receipt of
mail would be: (a) decrypt the envelope; (b) validate the postage stamp;
and (if the stamp is valid) (c) forward the message according to the
now-decryped instructions.

Using this model, if the perpetrator doesn't include a postage stamp,
then the message is ignored.  If the perp includes a stamp, the first
horny net geek's message is relayed but subsequent ones get bounced for
invalid postage.

If the message requires external postage (remailer processing cycle is
process postage *before* decrypting envelope), then at the very least
the horny net geeks have to get their own postage stamps, putting a step
in the way of instant gratification.  What's more, doing this would
require *some* understanding of how the remailer network operates.  One
should never underestimate the degree of cluelessness present on the
net, but knowing how to use remailers makes it more likely that somebody
could recognize this as a mailbomb rather than a legitimate offer.

What's more, even external postage works to block this attack used with 
a chain of remailers, because the second remailer's stamp would have to
be provided by the perpetrator, inside the encrypted envelope sent to
the first one.

The very nature of this attack makes me wonder whether it would be
worthwhile to implement a digital postage scheme for remailers that
doesn't happen to be backed by real money.  The remailers would continue
to be free to use, and currency exchange hassles would be avoided, but
many of the benefits of abuse prevention would be in place.  So would
the infrastructure to upgrade to pay-to-play remailers at a later date.

- -- 
   Alan Bostick             | He played the king as if afraid someone else 
Seeking opportunity to      | would play the ace.
develop multimedia content. |      John Mason Brown, drama critic
Finger abostick@netcom.com for more info and PGP public key

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQB1AwUBMPfnweVevBgtmhnpAQH1egMAk1MK45EQGYPseEjBLQfXTW9Wxl2OGHpg
2JoVjs/9N8PMElcwTCRSpKvP9aZQ3UgEqDhDkcTe7z+W20VmcXOxZalj71t/NjeV
vHqpa3rJ7vF0VcPl2OhKvZz1pBW1oia4
=6zkD
-----END PGP SIGNATURE-----