OK People this spam is driving me nuts. The other day I sent an email to mailblocks.com. Which is a public webmail almost totally spam free. How you say? Well their server sent me back an email saying :
“You are getting this email to verify that you are a valid sender, not a spammer or a computer, please type the characters you see below (which was a bitmap with the funky lettering in it) So that we may know you are a valid sender.”
So anyhow, after I do this and am verified, I can email this person from now on because I’ve been certified as a valid sender. If I were a computer forwarding email, or a spammer spoofing his address, it will never get through. I then saw some other domain also using this system. I was thinking it was a really great system. Does Lotus have anything like this, and how easy would it be to create?
This is essentialy a Whitelist functionality. Earthlink uses BrightMail (which is also available for Notes, but can be expensive). Basically, a copy of your address book is maintained on their server and if mail comes in that is not in your address book, one of 2 things happens:
If it is known spam, it goes to a known spam folder and is automatically deleted after a period.; or
If it is not sure, it goes to a “Suspect” mail folder and the send is sent a form link they need to go to to request to be added to your address book. You also have the option to add them before they do this. The downside is that you have to do it through the web-mail interface. You also have some degree of control over the level of filtering.
The big plus: our family’s Pop-mail account has been Spam Free for some time now!
The downer was having to manually add all the addresses to the address book when first setting it up.
For personal use, the idea is good. For business use, not always so good.
Sometimes a consumer will want to sign up for something but will not know in advance what address the newsletter or special offer will come from. So the end result is that the communication is deleted or put in a Spam folder (sometimes these are important one time reminders, eg. flight status notifications).
For other business use, perhaps to other businesses, the managed list of addresses could be so large it would not be feasible to maintain the list and would interrupt business communications.
But with Spam everything is a compromise. The user will probably always have to take some responsibility, unless you take that option where an outsourced worker in another country reads all your email for personal filtering with maximum results :).
I don’t see Lotus/IBM coming up with something like this, for the same reason there are way too many ‘secure email’ vendors out there; there are too many ways to approach the problem and few options that are best for everyone.
Challenge/response is a great idea and can work extremely well if you approach it properly. See http://www.spamdam.net for more information and a free trial. The product, Spam Dam, works almost transparently to the end user and requires only a simple e-mail response from new senders. There is NO administrative intervention required. Spam Dam pretty much runs itself, as long as the senders reply correctly to the challenges (yes, that is the potential flaw, but most people seem to reply to the challenge without any trouble). It’s also very easy to check the “Spam Can” for quarrantined messages and rescue them (stuff from automated sources and people who don’t reply properly).
I know from using it myself for a year and a half now that it is easily as effective as any other antispam system out there while being one of the simplest systems to manage (no admin support and very little end user involvement required).
I don’t know the answer to your question; seems like it should be possible to program with the DSAPI but I don’t know that anyone has.
I’d like to comment on the effectiveness of the spam countermeasure.
It does seem like a good idea, and is likely to cut back on spam quite a bit. Spammers are going to have to take measures to discover which addresses are already valid, so that they can fake those in their message headers. These would include things like viruses that harvest addresses from people’s address books (if A is in B’s address book, then A and B probably already recognize each other as valid senders). Also, they’re likely to create catalogs of known good addresses for a particular domain (each ISP must make certain addresses valid to communicate with their customers). Likewise, the website where their spider located an email address is likely to provide an indication of what senders the user is likely to have as already valid. E.g. if you found the address on fool.com, spoof the address that fool.com uses to send newsletters to its subscribers.
It remains to be seen how effectively spammers can combat this tool, but they’re very motivated. We’ll see.
I have heard of cases where spammers are harvesting the autoresponses then replying to them so they have a way to continue spamming. That is my biggest concern about using something like this.
I can see this as being a major pain to administer. I have some 50,000+ users in my Domino Directory, and I’d hate to have to tell all of them that they have to manually enter the addresses that they want for inbound SMTP mail. Conversely, with my users scattered around the globe, getting the instructions in different languages, and then supplying all of that info to our vendors and business partners would also be very time consuming to say the least.
these white list type of processes work OK for personal accounts, but are difficult in a commercial environment. I get lots of one time emails from people, and it would be a real pain to add each one of these to a white list.
Sorry to rain on your parade, but this is not new and it won’t work on any significant scale.
Search Google (groups) for Challenge/Response and you will find plenty of discussion, some dating back years.
Why won’t it work? Well I have no time to provide all possible illustrations, but one should suffice:
say you have users who wish to sign up to a properly maintained, confirmed opt-in mailing list.
they sign up at a web page and the list server sends the confirmation email with a token to verify the opt in.
your server sends the challenge (type in the code you see in this messy bitmap) to the list server
the list server a) ignores it b) forwards it to the list administrator who ignores it
your user never sees opt in confirmation and can never thus opt in
Actually while I am thinking about it there is the worse scenario of the deadly embrace where two C/R systems start forwarding challenges to each other in an infinite loop.
I am quite sure with a bit of ingenuity you could create a C/R system using native Notes/Domino functionality but it really isn’t worth the trip - sorry.