Anti-Spam Program Raises Backfire Fears - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Software // Enterprise Applications

Anti-Spam Program Raises Backfire Fears

Some leading anti-spam activists fear the challenge-response system could render E-mail useless if it's widely adopted

NEW YORK (AP) -- It's being promoted as a surefire way to eliminate unsolicited E-mail: Force senders to prove they are human rather than one of those automated programs that inundate the Internet with spam.

Known as challenge-response, the technology obliges a sender to verify their authenticity before their electronic messages can be accepted.

But the technique has consequences far beyond stymieing spam-spitting software robots, and some leading anti-spam activists fear it could backfire and render E-mail useless if widely adopted.

EarthLink introduced challenge-response last week to its 5 million subscribers, which means legitimate senders of E-mail could now face many more hoops to get their messages delivered.

While the technique is not entirely new, usage has been limited to the thousands. But EarthLink expects half its customers will turn on the free service by year's end and other Internet providers are weighing a similar offering.

"It's sufficiently tempting that people will use it and will not realize all the bad things that will begin happening," said Steve Atkins, an anti-spam consultant in Redwood City, Calif. "Challenge-response is very, very unfriendly and rude to legitimate senders of E-mail."

It typically works like this: When a recipient gets E-mail from an unknown sender, software automatically returns a message--a challenge--requiring the sender to perform a task such as filling out a form. Presumably, spammers won't bother.

Supporters liken the technique to knocking on a door and asking permission for entry.

Recipients may pre-approve senders--the equivalent of giving them a set of keys so they won't have to knock every time. But if recipients forget, E-mail discussion lists and the people who run them could get bombarded with challenges. Some lists have thousands of subscribers.

Worse, some of those messages could get broadcast to all of a list's recipients, some of whom might send back additional challenges, creating an endless and annoying "mail loop." (Early attempts to design automated "out-of-office" messages suffered similar problems).

In light of EarthLink's announcement and the prospect of millions more users sending challenges, many list administrators already have vowed to ignore them, effectively barring recipients who employ the technique.

"They can get pretty overwhelming is a nice polite way of putting it," said David Farber, a former Federal Communications Commission chief technologist who runs a 25,000-member list on technology.

Though Farber is sympathetic to the war on spam--up to half his inbox is junk--he considers challenge-based techniques too simplistic.

EarthLink's spam filter blocks up to 80 percent of spam. But spam has increased sixfold over the past 18 months.

The company decided to offer its customers the challenge-response option because cranking up spam filtering would only cause more legitimate mailings to get tossed by mistake, said Jim Anderson, vice president of product development.

"It's as close to a silver bullet as you're going to get," Anderson said. "We're simply providing a tool for customers to retake control of the inbox from spammers."

Others deem challenge-response a knee-jerk reaction.

"I'm worried people are going to implement systems like that too quickly because they are so desperate," said Eric Thomas, chief executive of L-Soft International Inc., a Swedish company that makes the popular Listserv mailing list software. "The cure might be worse than the ailment."

America Online now blocks up to 80 percent of incoming E-mail traffic, or more than 2 billion messages a day.

But company spokesman Nicholas Graham says AOL won't adopt challenge-response because having to send out 2 billion challenges a day would tax the system. And why create delays for subscribers?

"They don't want to hear 'You got mail and you just have to wait a few minutes longer,'" Graham said. "They expect to get E-mail quickly and responses quickly."

Anderson said EarthLink has developed the system over several months to minimize the burden on users and list administrators.

Standards call for messages from mailing lists to come with a priority code marked "list" or "bulk." EarthLink's software wouldn't challenge such messages. But because spammers can easily incorporate such coding, such messages would be sorted to a "suspect mail" folder.

The pre-approved sender scheme also difficulties because it doesn't work well with Yahoo Groups and other services where multiple list members post.

Online receipts from and other E-commerce sites also create problems; because they are automated, they won't respond to challenges.

Robert Craddock, chief executive of challenge-response developer, said that although the system requires legitimate senders to do more work, "I don't think that's a lot to ask in this day and age when everybody's E-mail box is getting inundated."

Some spam experts question whether such techniques will even work. They believe spammers will figure out how to automate responses to challenges--and also learn to make messages appear to come from pre-approved senders--or are themselves "challenges," said John Levine, a board member of the Coalition Against Unsolicited Commercial E-Mail.

"It's very easy to come up with things that look like a solution," Levine said. "Lots of people say this will solve everything, spam won't be a problem anymore. Of course, they said the same things about a variety of previous techniques."

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
InformationWeek Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

Remote Work Tops SF, NYC for Most High-Paying Job Openings
Jessica Davis, Senior Editor, Enterprise Apps,  7/20/2021
Blockchain Gets Real Across Industries
Lisa Morgan, Freelance Writer,  7/22/2021
Seeking a Competitive Edge vs. Chasing Savings in the Cloud
Joao-Pierre S. Ruth, Senior Writer,  7/19/2021
White Papers
Register for InformationWeek Newsletters
Current Issue
Monitoring Critical Cloud Workloads Report
In this report, our experts will discuss how to advance your ability to monitor critical workloads as they move about the various cloud platforms in your company.
Flash Poll