IBM researcher Nathaniel Borenstein has commented that everyone agrees that spam is bad, and that’s a huge impediment to doing anything about it. Having decided that spam is bad, it’s tempting to divide the spam problem into smaller problems and try to solve the smaller problems, then put the solutions to the subproblems together and, voila, no more spam. That would be fine if the combined subproblems were truly equivalent to the spam problem, but that’s rarely the case.

A common approach is to divide the spam problem in to the authentication problem and the introduction problem. The authentication problem involves ensuring whoever claims to have sent an e-mail message really did send it (or as a minor variant, that the recipient can detect and reject forgeries.) Authentication has gotten a lot of attention with systems like PGP, S/MIME, SPF, Sender-ID, and Domain Keys. While it’s far from solved, it’s fairly well understood.

The introduction problem involves vetting mail from people who haven’t written before. The idea is that a recipient keeps a list of people who’ve sent good e-mail. When a message arrives from someone not on the list, the sender does something to indicate good faith or non-spamminess, and is then added to the recipient’s list. If the introduction fails, the recipient might put the sender into a bad senders list, or just ignore the message so future mail from the same sender will require another introduction attempt.

The introductory something can be fairly complex and onerous, since each sender only has to introduce himself once to each recipient, and it should be onerous enough that spammers won’t go to the effort to do it. In such a system, we’d expect bad guys to try to circumvent the introduction by forging mail from someone already in the recipient’s list. That’s why the introduction approach is only useful if the authentication is good enough to prevent forgeries.

Viewed in this way, a lot of anti-spam proposals turn out really to be introduction proposals. Challenge/response, hashcash, CAPTCHAs (blurry pictures of words that the user has to retype), and refundable e-postage fall into this category. While some of these proposals are quite clever, and some of them are plausible solutions to the introduction problem, none of them solve the spam problem, because the introduction problem is not the spam problem.

For one thing, the introduction approach doesn’t match the way that people really use e-mail very well. Its model is that a stranger will write to you, you’ll decide whether you like the stranger’s mail, and then add that e-mail address to your accept or reject list. But people visit a vendor’s web site, order something, get order confirmations and (if they ask for it) newsletters from the vendor. But what address will the confirmations and newsletters come from? It’s rarely possible to predict. We can imagine schemes where as part of the ordering transaction the vendor adds its addresses to the user’s good sender list, but even if such schemes could be designed and deployed, they would be a tempting target for bad guys to subvert and stuff their addresses into unwitting users’ lists.

For another, the introduction scheme presumes that senders’ behavior stays the same, that someone who sends good mail will always send good mail and vice versa. That strikes me as extremely optimistic. In the late 1990s, spammers sent spam through other people’s existing mailing lists. They don’t spam that way now since other approaches are easier, but if the fastest way into people’s good sender lists is to piggyback on other mailing lists, they’ll do it again. They’ll join the list, possibly sending out an innocuous message or two, then blast out spam to the list until the list owner notices and cuts them off. (Yes, this has happened.)

The introduction approach presumes both that mail from unknown senders is probably spam, and that legitimate senders are interested enough in getting their message delivered to bear the burden of the introductory something. This may be true, or it may not be. I often see someone ask a question on a mailing list or newsgroup, send them an answer to the question, and get back some sort of introductory challenge. Am I going to jump through their hoops to do them a favor? Probably not.

Finally, the spam problem is unwanted bulk mail, regardless of where it comes from, not mail from strangers. I publish contact e-mail addresses in my books, and readers send me a lot of mail. It’s from people who haven’t written to me before, and it’s not spam. An accreditation system (third parties that vouch for senders) would help manage that problem a lot better than an introduction system.

Introduction systems aren’t inherently bad, but they’re not inherently related to spam, either.