238596 - Integrate a Challenge/Response Spam Block in to Thunderbird

Status: RESOLVED DUPLICATE of bug 156744

(Thunderbird :: General, enhancement)

Description

[Rory]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040206 Firefox/0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

The Spam Filter system is good for its design but dated.  Suggestion to
Integrate a Challenge/Response Spam Block Option in to Thunderbird.

This would begin to begin on Thunderbird "white lists" in its Junk Control Section.

A basic Challenge/Response system works like this.
An email is sent to you...
If it's on your White List, it's allowed through.
If it's on your Black List, it's discarded.
If it comes from a non-existent domain, it's automatically discarded.
Otherwise, a challenge/response system will send out a verification email to the
address who contacts you. If they respond, the email gets through. If they
don't, it doesn't.  Some C/R systems depend on web verification, but simple
email verification works just as well and senders don't mind it.

In Thunderbird, a panel could allow you to see what's waiting to be verified,
what's been discarded and what's been delivered to you. Email programs are the
best tool for running a system like this from, so it makes sense that it's
integrated.

A very good Challeng/Response system to refer to is called (Steven)
http://www.softwaredevelopment.net.au/pge_steven.htm.

I get absolutely NO junk mail now. It works amazingly well. I think
well-designed C/R Spam systems are the next big wave. If Thunderbird integrated
one right in to its package, it would be huge news and very popular. Plus, it
would stop people from getting any junk mail. 

It would take some work to integrate but it would be big news in the Email App
world.  

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1

[JoSH Lehan]

Unfortunately, there are serious patent problems with a challenge/response email
filter, at least in the US.

http://www.cleanmymailbox.com/mailblocks.html
http://news.com.com/2010-1032_3-1003921.html
http://www.spamwolf.com/patents/prior_art.html

If interested in doing more research on this, the patent numbers are 6,112,227
and 6,199,102.

Comment 2

[Lorenzo Colitti]

*** Bug 230862 has been marked as a duplicate of this bug. ***

Comment 3

[Panos Stokas]

Challenge/response must be used in combination with Bayesian filtering and only
as the last resort!

First of all, I believe that there is no longer an issue about patents. See
http://www.interesting-people.org/archives/interesting-people/200306/msg00145.html
Apparently, common sense has prevailed -- in this case.

However, there seem to be issues with the effects of current C/R applications.
Indeed, there are commercial email filters out there that challenge every
unknown sender without any other consideration. These filters are harmful.

Objections to this kind of challenge response can be found here:

http://tardigrade.net/challengeresponse.html

and here:

http://www.templetons.com/brad/spam/crgood.html

When considered on the grounds of C/R being the only means to filter, most of
the above arguments are valid. However, if C/R is provided as the last means to
save email that has been already marked as spam and which the user would not
read -- then I think that none of the above arguments can stand.

Specifically, on a system that uses challenge response only on email that has
been marked as spam, the argument:

1) Challenge-Response is a guilty-until-proven-innocent scheme

Is invalid because it applies only on those found guilty already.

2) Challenge-Response will prevent you from getting a wide variety of real mail

Is invalid because it is about getting email that you would not read since it
was marked as spam.

3) Challenge-Response will keep you off of a lot of mailing lists

Is probably invalid because mailing lists are not marked as spam. However, it is
possible that some list messages are considered spam and then challenged. This
is an issue that could be easily resolved by looking at the headers and
preventing challenges to be sent to lists.

4) Forged 'From' addresses OR The Challenge is just as annoying as spam 

Is invalid because a good filter could automatically reject challenges from
addresses to which no recent email was sent.

5) Challenge-Response can overload mail servers

Is invalid because challenges are very small and they should not contain images,
but a simple question in English and any other language known to the challenger.

6) Speed Issues

Is invalid because regrettable as the slowdown is, its but far better than not
reading mail that was meant to be read.

---

In light of the advantages of a challenge response system provided in addition
to Bayesian filtering, I hope the Mozilla Mail team will consider adding C/R as
a suboption to junk email filtering.

Comment 4

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 5

[Gervase Markham [:gerv]]

This bug has been automatically resolved after a period of inactivity (see above
comment). If anyone thinks this is incorrect, they should feel free to reopen it.