Dean Anderson wrote: > Then using the IETF list as an example, you would need the entire list of > recipients and their public keys, and you would need to send a message > either directly to each of them, one by one, or send a single message with > a session key for each recipient (thousands). This isn't going to work. Let's not mix apples with speedboats. These are some options with the proposal: #1: no encryption is used either way, the list address is in a whitelist for each recipient. #2: each recipient can only send encrypted msgs (possibly, also signed) to the list, with the list's key, for distribution. The listserver verifies and resends the messages in plain text, where #1 applies for each recipient. #3: the list receives messages as in #2 but the listserver sends the msgs as encrypted mail to each recipient, with each recipient's key. IETF.ORG, possibly, should be #1. No problem in using postcards here. However, to help prevent spam, IETF.ORG can use #2. > Second, even if the above weren't a problem, one still has the problem > that a virus infected user will still be sending messages, just like > everyone else. Again, his would not work well with the proposal, due to the encryption being per message. And the hijacked user would tend to notice any heavy usage. > You can't make it more expensive without shooting yourself in the foot. > In information theory-speak, you can't prevent a covert channel** unless > you have no channel at all. By the addition of a correction channel (Shannon's 10th theorem), a covert channel can be detected with a probability as close to 100% as I wish. > Covert-channel detection is a whack-a-mole game. Not really. It can be modeled, it can be improved. > Putting it in different terms, how can the government make sure those > "government use only" stamped envelopes are only used for government > business? Easy. By applying Shannon's 10th theorem. Sample enough mail at distribution centers (going back to the source, which is possible even without a legal mandate to open the envelopes) and bar the culprits from sending govt. mail until the probability that any mail is incorrectly using govt. envelopes is a close to zero as desired. > There is no scheme in which the rules can't be broken by someone intent on > breaking them. This may sound good but is incorrect. Systems can be designed such that a set of properties remain effective if most or even all parts of the system fail (for whatever reason, including attacks). > The only path is to detect them, and prosecute them. There is no world law, no unified way to prosecute. Even venue is hard to guarantee (allowing you to prosecute the culprit). > In > the case of spam, detection is easy, but not automatic. Prosecution is > now possible. Its still a whack-a-mole game. It won't end unless you can > get past the virus infection to the virus operator, and hopefully, there > aren't really too many virus operators. Of course, we aren't stopping > spam either in a very real sense, but rather abusers who are annoying and > mailbombing people. But by my count of my inbox, if you stop those > people, I can certainly handle the rest which amounts to maybe 1% of my > current junk mail. When you outlaw spam, only the outlaws spam. So what? The problem still remains, even if you call them outlaws. Also, users should not have to sue spammers, or have any other burden, in order to protect the users' resources. Imagine if I would have to manage 300 lawsuits a day (the average spam rate that my system cannot automatically detect as spam)?