1 1

Best Practices for End Users

Anti-Spam Research Group

IETF 56 - San Francisco

March 20, 2003

John Morris

ftp://67.cdt.org/pub/ietf56-asrg-spamreport.ppt

or MAYBE at http://www.ietf.org/proceedings/03mar/

2

New Report on Spam issued Yesterday by CDT

• “Why Am I Getting All This Spam?”

• Reports on six months of research

• Generally aimed at end users

• Focused on different aspect of problem– How do spammers get my e-mail address?

• Available in HTML or PDF:– http:\\www.cdt.org\speech\spam\030319spamreport.shtml– http:\\www.cdt.org\speech\spam\030319spamreport.pdf

3

Methodology

• Created hundreds of single purpose e-mail addresses• Placed on Web sites, USENET, Web discussion boards, e-

commerce transactions, domain registrations• Disguised some addresses:

– using words: “example at domain dot com”

– using HTML characters: "example@doma&

#105;n.com"

• Removed or opted-out some addresses after two weeks• Tracked spam for 6 months• Ignored spam stemming from dictionary attacks

4

Key Finding: Vast Majority of Spam Scraped from Web Sites

5

Key Finding: Disguising Addresses is VERY Effective

• Spam received at addresses only displayed using words: ZERO– “example at domain dot com”

• Spam received at addresses only displayed using HTML characters: ZERO– "exampl

e@domain.com"

6

Key Finding: Removing Plain Text Addresses from Web Helps

7

Key Finding: USENET was Second Biggest Source of Spam

• Vast majority of addresses scraped from USENET headers– 99+% of USENET spam from headers– Very little spam from body of message

• Which newsgroup makes a difference– Postings to alt.sex.erotica > lots of spam– Postings to misc.industry.insurance > no spam

8

Key Finding: Where Offered, Web Site Opt-Out Requests Work

• All tested sites (31 diverse sites) honored opt-out requests if made at e-mail address was first provided

• Most (but not all) sites promptlyhonored opt-out requests when made two weeks after e-mail address was first provided

9

Key Finding: Web Discussion Forums are Fairly Spam Free

• Almost no spam to addresses posted in Web based discussion boards, job listing sites, or auction sites.

• Also, very little spam from WHOIS listing– But, none of the domains were approaching

time for renewal

10

Best Practices to Avoid Spam

• Disguise any e-mail addresses that are listed on web sites

• Don’t post to USENET using a live address in the header (but okay in body if disguised)

• Opt out at the time you give your address to a web business (and don’t do business with sites that don’t offer opt-out options)

• Use multiple or disposable e-mail addresses