Attacking back at the Spammers

Some of my friends and acquaintances know that I am have been experimenting with a new scheme to control spam email.  Like many people, I have had to abandon email addresses in the past due to over-abundance of spam.  When you open a new email address, there is no spam.  But as you continue to use the box, eventually the knowledge that you are actually using a particular email address gets out.  Once your email address becomes known to the spammers there is no sure way to get them to forget it.

A verified email address has value, and lists of email addresses are traded and bartered in the spam underworld.  Even a non-verified but potentially valid email address has value.  Sending a piece of spam does not cost much, but it has a cost.  Sending to all possible email addresses (start with aaaaaaaa@aaaaa.com, then aaaaaaab@aaaaa.com, etc) is not viable.  Spammers want an email address that is known or at least likely to work.

You could say that a particular email address has value because it is so much rarer than a completely random email address.  A list of 1000 addresses that reaches 1000 people is the same value as a list of 100,000 addresses that reaches 1000 people.  From a spammer’s perspective, you would like every email address to be valid (reach a person) forever, and have no addresses that go to dead ends.  When people change their email address, there is a cost (albeit small) to the spammer, because the old email address become invalid.  My goal then is to frustrate spammers by filling their lists with invalid email addresses.

The Answer

The value of my email address is due to its relative rareness.  I can decrease the value of a particular email address, by increasing the number of email addresses I use.  The idea is this: I can use thousands of email addresses out of a pool of billions of possible address.  I can use a unique email address for (almost) every occasion.  All of the email addresses deliver mail to me.  Imagine the extreme: I print my business cards with a unique email address on every card.  Anyone who uses the address has no problem sending email to me.

It is possible that in the course of normal email interchange, an email message with that address on it, gets posted to some sort of web page (e.g. email forum archive) and the spammers pick it up from there.   The anti-spam feature is that whenever I start to receive spam on a particular email address, I turn off (disable) the address.

What if a legitimate party was using that address?  What if that is the email address I gave to my mom to use to contact me?  This would block email from her as well.  Part of the scheme has to be keeping a record of who I have given the address to.  When I turn that email address off, I go back to the legitimate person that I gave it to (e.g. mom), and give them a new email address to use.

You might be thinking correctly that this is onerous to have to tell people to use a different address.  But keep this in mind: if I have given unique addresses to each of my hundreds of correspondents, then all of those addresses except this one remain unaffected.  In the past, I have had to abandon entire email inboxes to ALL correspondents, and send them ALL a new address.  Since there is no way I can remember all of them,  I undoubtedly lose a many along the way.  The need to abandon an email address is rare in general, and contacting one person to switch is painful, but far better than contacting all your contacts.

Version 1.0

About 6 months ago I put in place a plan to experiment with.  It turns out that the XPDL.ORG site, which I help run, has unlimited free email forwarding.  So what I did was create new cryptic email addresses, and forward them all to my regular email inbox.  For example:

kds_Why54TzrvyZfgzNqqerf@xpdl.org

Every time I signed up for some sort of online service or account, I would create a new forwarding address. I created a private wiki page where I recorded the cryptic address, who or what I gave the address to, and when I did that.  The idea is that if I ever have to turn that forwarding off, I can get back in touch with whomever I gave it to.

The email address must be long so that it can not be guessed.  For example if I just use “keith1”, “keith2”, etc. it would be too easy for the spammers to guess other valid email addresses.  This could cause me to have to turn off many many addresses inconveniently.  If I make the address long and cryptic, then it is very very hard to guess other legitimate addresses, making those addresses relatively safe.

Most of these email addresses are entered into online forms, and used by those services, without anyone actually having to read them, or type them, so it really does not matter how long and complex the email address is.

It is not perfect…

What about “from” address on email?  On my standard email, I created a new cryptic address as my “from” address every month. It does not matter how long or complicated an email address is when people simply use the “reply” button.  Cycling every month is not perfect because if someone puts that email in their address book, and it also gets on a spam list, I might turn it off, and I don’t know who using that address, so I don’t have any way to let them know a newer address to use.  Creating a new unique address for every email might be better, because this decreases the chance that someone would hang on to an address that also got on a spam list, but that causes other difficulties.

Some services require you to log in using your email address.  If you really want to keep your “real” address private, then you have no choice but to give them and use the cryptic on to log in.  Typing that long and meaningless address is a pain, so in those cases I have to create an address that is easier to remember and type, which unfortunately decreases its security.

Because you are using many email addresses simultaneously, it is possible to start getting multiple copies of a message.  For example, if a message comes to you using address “a”, and you reply to it using address “b”, then both addresses become part of the ongoing email address.  Some email in-boxes are smart enough to eliminate the duplicate, but not all are.

Every time you sign up for a mailing list, you use a unique cryptic email address, but again this can cause message multiplication when the message is addresses to multiple lists which have different email addresses for you.

In the six months that I have been doing this, I have not had the opportunity yet to turn off an email address.  This is because it takes time to get on those spam lists, so as far as I know, none of my “new” email addresses that are less than 6 months old are on any lists yet.    So it is really too early to tell.  It is also true that going to the admin interface and creating a new cryptic email address, recording what I am using it for, and then using that in the sign up form, makes signing up for any service quite a bit more trouble.   Sometimes I am too lazy, and just go ahead and use the fixed address because it is easier.

Version 2.0

I just found out about a new service called otherinbox.com.  This is the service that I have been looking for, and it is aimed at exactly this problem.  (Scott Francis: you mentioned this service to me a while ago, but it took me this long to investigate.)

You get an account ($20/year – trial accounts are free) and it gives you an infinite number of email addresses which all go to you.  It has all the capabilities described above, including the ability to block an address at any time in the future.  You can record notes about a particular address to remind you of who you gave the address to, and when.

There is one particular improvement over my old scheme: you don’t have to set up the address in advance.  When signing up for an account at Barnes and Noble I can create a suitably cryptic address on the fly, and it will automatically create the inbox for that address without extra work from me.  Usually such services start by sending an email for you verify that you own the address, so I can go to the otherinbox.com, find that new email address, and set the address to be forwarded.  This is so much nicer to do later instead of having to do it before you sign up, particularly when you are not on line.  You can even make up an address while filling in a paper form with a pencil, and eventually the account is created for you — if needed.

They have a lot of other features for filtering and such.  Email can be forwarded, or picked up directly from their web or IMAP interface.  If you want, you can let the email pile up there, and receive only a digest of the email once a day.  That might be really handy with some of the email lists I am on.

Contemplations

Perhaps this seems like a lot of trouble, to have to set up and manage a bunch of different email addresses so that you can have the option to cut one off if necessary.  To be honest: it is lot of trouble.  OtherInBox looks like a lot less trouble than my initial way, but it is still more trouble than just being able to give out a single address forever.  Some of the need for this might go away if we had widespread cryptographic signing of email messages so we could know who the email came from, but there are many forces working against that.  Signed messages would not help in a mailing list situation when you are exchanging messages with people you do not know.   There are some possibilities that social software will offer some benefits in this area, once they have matured a bit more. So for now given the current infrastructure, this looks like the best hope for combating spam.