Penny Black (research project)

Last updated

The Penny Black Project is a Microsoft Research project that tries to find effective and practical ways of fighting spam. Because identifying spams consumes a recipient's time, the idea is to make the sender of emails "pay" a certain amount for sending them. The currency or the mode of payment could be CPU cycles, Turing tests or memory cycles. Such a payment would limit spammers' ability to send out large quantities of emails quickly.

Contents

The project's name is derived from the Penny Black, the world's first adhesive stamp used for prepaid postage. [1] [2]

Objective

The goal of the project is to move the e-mail costs from the receiver to the sender. The general idea is that if the sender must prove that they have expended a certain amount of effort specifically for the receiver and the message alone.[ citation needed ]

The project aims to devise a method to do this without introducing additional challenge-response mechanisms and third parties, and without requiring extra maintenance and updates, while retaining the current architecture of the e-mail system. [3]

Ticket server

One of the project's ideas was the "ticket server", a credit-based method for validating emails. Tickets would be required to perform actions, such as sending emails. There are three operations the ticket server provides: "request ticket", "cancel ticket", and "refund ticket".[ citation needed ]

The server would allow the user to request a ticket in exchange for a proof of work: expending CPU cycles solving hard algorithms with processing power, Turing tests, or even just by paying money. The server could also cancel a ticket. For example, after receiving an email with a ticket, the receiver could request the ticket to be cancelled so it cannot be reused. The person who cancels a ticket also has the option to refund the ticket to the sender. This causes the original sender to regain a new ticket. For example, a user might refund a ticket that came with an email if it was not spam. [4]

Using this, friendly and trusted emails would have little to no cost as tickets would be frequently refunded. However, spammers would be required to invest either a lot of computing time or money in order to create enough tickets to send large numbers of e-mails.[ citation needed ]

See also

Related Research Articles

<span class="mw-page-title-main">Email</span> Mail sent using electronic means

Electronic mail is a method of transmitting and receiving messages using electronic devices. It was conceived in the late–20th century as the digital version of, or counterpart to, mail. Email is a ubiquitous and very widely used communication medium; in current use, an email address is often treated as a basic and necessary part of many processes in business, commerce, government, education, entertainment, and other spheres of daily life in most countries.

The Simple Mail Transfer Protocol (SMTP) is an Internet standard communication protocol for electronic mail transmission. Mail servers and other message transfer agents use SMTP to send and receive mail messages. User-level email clients typically use SMTP only for sending messages to a mail server for relaying, and typically submit outgoing email to the mail server on port 587 or 465 per RFC 8314. For retrieving messages, IMAP is standard, but proprietary servers also often implement proprietary protocols, e.g., Exchange ActiveSync.

A tarpit is a service on a computer system that purposely delays incoming connections. The technique was developed as a defense against a computer worm, and the idea is that network abuses such as spamming or broad scanning are less effective, and therefore less attractive, if they take too long. The concept is analogous with a tar pit, in which animals can get bogged down and slowly sink under the surface, like in a swamp.

Various anti-spam techniques are used to prevent email spam.

<span class="mw-page-title-main">Registered mail</span> Postal service

Registered mail is a postal service in many countries which allows the sender proof of mailing via a receipt and, upon request, electronic verification that an article was delivered or that a delivery attempt was made. Depending on the country, additional services may also be available, such as:

<span class="mw-page-title-main">Email spam</span> Unsolicited electronic advertising by email

Email spam, also referred to as junk email, spam mail, or simply spam, is unsolicited messages sent in bulk by email (spamming). The name comes from a Monty Python sketch in which the name of the canned pork product Spam is ubiquitous, unavoidable, and repetitive. Email spam has steadily grown since the early 1990s, and by 2014 was estimated to account for around 90% of total email traffic.

Sender Policy Framework (SPF) is an email authentication method which ensures the sending mail server is authorized to originate mail from the email sender's domain. This authentication only applies to the email sender listed in the "envelope from" field during the initial SMTP connection. If the email is bounced, a message is sent to this address, and for downstream transmission it typically appears in the "Return-Path" header. To authenticate the email address which is actually visible to recipients on the "From:" line, other technologies such as DMARC must be used. Forgery of this address is known as email spoofing, and is often used in phishing and email spam.

Hashcash is a proof-of-work system used to limit email spam and denial-of-service attacks. Hashcash was proposed in 1997 by Adam Back and described more formally in Back's 2002 paper "Hashcash - A Denial of Service Counter-Measure". In Hashcash the client has to concatenate a random number with a string several times and hash this new string. It then has to do so over and over until a hash beginning with a certain amount of zeros is found.

Greylisting is a method of defending e-mail users against spam. A mail transfer agent (MTA) using greylisting will "temporarily reject" any email from a sender it does not recognize. If the mail is legitimate, the originating server will try again after a delay, and if sufficient time has elapsed, the email will be accepted.

A bounce message or just "bounce" is an automated message from an email system, informing the sender of a previous message that the message has not been delivered. The original message is said to have "bounced".

Email authentication, or validation, is a collection of techniques aimed at providing verifiable information about the origin of email messages by validating the domain ownership of any message transfer agents (MTA) who participated in transferring and possibly modifying a message.

Proof of work (PoW) is a form of cryptographic proof in which one party proves to others that a certain amount of a specific computational effort has been expended. Verifiers can subsequently confirm this expenditure with minimal effort on their part. The concept was invented by Moni Naor and Cynthia Dwork in 1993 as a way to deter denial-of-service attacks and other service abuses such as spam on a network by requiring some work from a service requester, usually meaning processing time by a computer. The term "proof of work" was first coined and formalized in a 1999 paper by Markus Jakobsson and Ari Juels. The concept was adapted to digital tokens by Hal Finney in 2004 through the idea of "reusable proof of work" using the 160-bit secure hash algorithm 1 (SHA-1).

Emailtracking is a method for monitoring whether the email message is read by the intended recipient. Most tracking technologies use some form of digitally time-stamped record to reveal the exact time and date when an email is received or opened, as well as the IP address of the recipient.

Memory bound refers to a situation in which the time to complete a given computational problem is decided primarily by the amount of free memory required to hold the working data. This is in contrast to algorithms that are compute-bound, where the number of elementary computation steps is the deciding factor.

A challenge–response system is a type of that automatically sends a reply with a challenge to the (alleged) sender of an incoming e-mail. It was originally designed in 1997 by Stan Weatherby, and was called Email Verification. In this reply, the purported sender is asked to perform some action to assure delivery of the original message, which would otherwise not be delivered. The action to perform typically takes relatively little effort to do once, but great effort to perform in large numbers. This effectively filters out spammers. Challenge–response systems only need to send challenges to unknown senders. Senders that have previously performed the challenging action, or who have previously been sent e-mail(s) to, would be automatically receive a challenge.

DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect forged sender addresses in email, a technique often used in phishing and email spam.

Domain-based Message Authentication, Reporting and Conformance (DMARC) is an email authentication protocol. It is designed to give email domain owners the ability to protect their domain from unauthorized use, commonly known as email spoofing. The purpose and primary outcome of implementing DMARC is to protect a domain from being used in business email compromise attacks, phishing email, email scams and other cyber threat activities.

Backscatter is incorrectly automated bounce messages sent by mail servers, typically as a side effect of incoming spam.

Since spam occurs primarily because it is so cheap to send, a proposed set of solutions require that senders pay some cost in order to send spam, making it prohibitively expensive for spammers.

<span class="mw-page-title-main">Epaulettes (stamp)</span> Stamp series issued in Belgium in 1849

Epaulettes is the name given by philatelists to the first series of postage stamps issued by Belgium. The stamps, which depicted King Leopold I with prominent epaulettes from which the name derives, became legally usable on 1 July 1849. Two denominations with the same design were issued simultaneously: a brown 10 centimes and a blue 20 centimes. They were produced as the result of a series of national reforms to the postal system in Belgium, based on the success of similar British measures adopted in 1840. The stamps allowed postal costs to be pre-paid by the sender, rather than the receiver, and led to a sharp increase in the volume of mail. Although quickly superseded by new types, Epaulettes proved influential and have since inspired several series of commemorative stamps.

References

  1. "The Penny Black". postalmuseum.org. Retrieved 2023-09-05.
  2. Seltzer, Larry (2004-03-21). "Can Computational Problems Stamp Out Spam?". eWEEK. Retrieved 2023-09-05.
  3. Dwork, Cynthia; Goldberg, Andrew. "Common Misconceptions about Computational Spam-Fighting". Archived from the original on April 11, 2013. Retrieved February 12, 2013.
  4. Abadi, Martín; Birrell, Andrew; Burrows, Mike; Dabek, Frank; Wobber, Ted (2003), "Bankable Postage for Network Services" (PDF), Bankable Postage for Network Services, pp. 3–4, archived from the original (PDF) on March 4, 2016, retrieved April 28, 2017