challenge-response considered harmful

[prog]

Inetersting post from Brian McNett seen on the Perl Mac OS X mailing list, after someone's challenge-response program started yelling at everyone who sent mail to that list...

This has happened to me as well. Challenge - Response is not good for mailing lists like this one, or indeed at all.

As someone who works in the anti-spam field, I can tell you up front that C/R is frowned upon at all levels as bad and wrong. Several key C/R vendors are in fact spammers, and the leader in the C/R field is a lawsuit-happy outfit which is attempting to kill off all its competition. All C/R systems work by intercepting your mail, and one even requires you give them your POP3 passwords to do it.

See: http://www.freedom-to-tinker.com/archives/000389.html
Also: http://tardigrade.net/challengeresponse.html
and: http://static.samspade.org/spamarrest.html

Both SpamArrest, and MailBlocks collect the email addresses from responses to challenges and reserve the right to market to them in their privacy policies. SpamArrest has been widely criticized as spammers for having done so. For the record, there is no privacy policy anywhere to be seen on the Max Strength Software websites. They are not required to have one, but because they don't they can do anything with the information you give them (including your email address), and you have no recourse. Would you trust anyone like that?

To anyone out there using C/R, please stop. Please?

Comments

[daerr.livejournal.com]

Yeah, that was pissing me off. I had intended to complain and I'm glad to see that someone did so.

[cortezopossum.livejournal.com]

I'm not entirely sure if I understand the whole C/R concept but I see one potential flaw -- How often do you get two computers, both with C/R systems, spewing challenge messages at each other recursively and neither recipient can see them.