Hacker News new | ask | show | jobs
by SXX 23 days ago
What always bugged me about whole email its that we still dont have two best and most reasonable practice to fight about abuse:

1 - Ability to pay once to provider give your domain Good reputation score to new or old domain and IP and whatever. Like pay once, be a good citizen.

2 - Or just use Hashcash or any other PoW.

This would really solve a problem with 99.9% of spam and allow actually more decentrolized email system.

Fact that no matter what you do its impossible to setup own emaik server to just send few emails a year with 100% guaranteed delivery is just beyond me.
2 comments
edelbitter 23 days ago
In a way, the "let the money decide who is a good citizen" already works. Just not in our favor: Most of the spam I receive is not from some rando using an IP I know nothing about. Its from providers that keep making good money with their current anti-abuse.. strategy. As much as I would like, I cannot refuse all mail from certain providers, because some of their customers are "important" and non-abusive. But I get the good and the bad all laundered together¹.

¹) Some do allow recipients to distinguish, e.g. Sendgrid add an X-Entity-ID header which is a stable 1:1 or <small-number>:1 map between short ascii identifiers and customers. So if you store that mapping, you can reject the usual "From: <admin@bigcorp.example> but not sent using the account associated with bigcorp.example". (The way they easily could, if they cared.)

link
bawolff 23 days ago
> Or just use Hashcash or any other PoW.

People love the idea of this, but i don't think it really makes sense.

How high do you set the PoW to? I dont think there is any middle ground that would actually deter attacks but not deter legit users.

link
SXX 23 days ago
When I have personal email server and I need just ocasionally send email or two it can be as high as possible.

I just want them delivered not into Spam folder.

link
bawolff 23 days ago
Yeah, but you pay the cost for outgoing messages and set the cost for incoming messages. The incentives aren't super well aligned, and its difficult to convince people to pay a cost to contact you when they cant force it to be reciprocal.

The point i was trying to make though, is that we are past the era of brute forcing email addresses to send spam. Most spam is at least a little targeted.

If you are an attacker and need to send 100,000 emails a week, that means your budget you can spend on each PoW is six seconds.

This is easily parallizable and you can get budget vps's for about $5/month (i dont know if its more ecconomically efficient to get more powerful VPS or lots of cheap ones, but your mail server is probably in the range of a budget vps so i think its a fair comparison).

So some back of the napkin math, if the marketer wants to send 100,000 emails a week it costs them very very roughly $1.25 per 6 seconds of PoW.

If they have a marketing budget of $500 (which seems very small by most advertising budgets). Then you need a proof of work that takes 40 minutes per email to deter them. I dont think most email providers would find that acceptable, and i also made a bunch of simplifying assumptions here that i think lean in the direction of making PoW sound better than it is.

link