On Sat, 12 Feb 2005 02:48:56 +0100, Bernhard Kuemel said: > If hashcash (http://www.hashcash.org/) gets integrated in our mail > systems we no longer need to hide or obfuscate our email addresses. On the other hand, widespread distribution of hashcash will probably mean the end of many mailing lists, because you can't trust users to actually whitelist everything they subscribe to. And remember that the whole *idea* of hashcash is that you make it impractical for somebody to send 3,000 pieces of mail. I'm sure netsys.com wouldn't want to keep full-disclosure if they had to do hashcash for even 10% of their users. I'll go out on a limb and predict that if hashcash catches on, most major mailing list packages will quickly acquire features to auto-unsub and auto-blacklist all addresses from domains that present a hashcash challenge, just out of self-defense. (And yes, unsub and blacklist *the entire domain* - if foo.com is bouncing mail that hasn't been whitelisted, you have to ban foo.com from all your lists. Otherwise you can be DoS'ed (either intentionally or accidentally) by simply subscribing 15 or 20 addresses and "forgetting" to whitelist the mailing list... I'll overlook the issues caused when you *dont know* what to whitelist. For instance - many mailing lists (including this one) have a "confirmation of subscription" check. For bonus points - should you have whitelisted: a) full-disclosure@xxxxxxxxxxxxxxxx (the actual list name) b) full-disclosure-request@xxxxxxxxxxxxxxxx (the rfc822 header on my confirm) c) full-disclosure-admin@xxxxxxxxxxxxxxxx (the rfc821 MAIL FROM:) d) mailman@ e) majordomo@ f) listserv@ (One or more answers may or may not be correct. Remember that at the time you send your subscription request, you probably have not actually seen any mail from the site, so you can't say "whitelist the address this mail came from"...) There's also all the stuff that things like amazon, ebay, your bank, your insurance company, your utility companies, etc... all send out, that users will forget to whitelist. But yeah, other than all those minor details, hashcash is a fine solution. ;)
Attachment:
pgp00064.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html