From fork-admin@xent.com  Mon Aug 12 11:09:47 2002
Return-Path: <fork-admin@xent.com>
Delivered-To: yyyy@localhost.netnoteinc.com
Received: from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id EDC1F4416E
	for <jm@localhost>; Mon, 12 Aug 2002 05:56:49 -0400 (EDT)
Received: from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Mon, 12 Aug 2002 10:56:50 +0100 (IST)
Received: from xent.com ([64.161.22.236]) by dogma.slashnull.org
    (8.11.6/8.11.6) with ESMTP id g7B80kb26483 for <jm@jmason.org>;
    Sun, 11 Aug 2002 09:00:46 +0100
Received: from lair.xent.com (localhost [127.0.0.1]) by xent.com (Postfix)
    with ESMTP id B0CFF294154; Sun, 11 Aug 2002 00:57:05 -0700 (PDT)
Delivered-To: fork@spamassassin.taint.org
Received: from relay.pair.com (relay1.pair.com [209.68.1.20]) by xent.com
    (Postfix) with SMTP id D562B294150 for <fork@xent.com>; Sun,
    11 Aug 2002 00:56:43 -0700 (PDT)
Received: (qmail 37713 invoked from network); 11 Aug 2002 07:57:45 -0000
Received: from adsl-67-119-24-15.dsl.snfc21.pacbell.net (HELO golden)
    (67.119.24.15) by relay1.pair.com with SMTP; 11 Aug 2002 07:57:45 -0000
X-Pair-Authenticated: 67.119.24.15
Message-Id: <00c801c2410c$c69b3a70$640a000a@golden>
From: "Gordon Mohr" <gojomo@usa.net>
To: "fork" <fork@spamassassin.taint.org>
References: <m2r8h6qumb.fsf@maya.dyndns.org>
Subject: Re: Forged whitelist spam
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-Msmail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2600.0000
Sender: fork-admin@xent.com
Errors-To: fork-admin@xent.com
X-Beenthere: fork@spamassassin.taint.org
X-Mailman-Version: 2.0.11
Precedence: bulk
List-Help: <mailto:fork-request@xent.com?subject=help>
List-Post: <mailto:fork@spamassassin.taint.org>
List-Subscribe: <http://xent.com/mailman/listinfo/fork>, <mailto:fork-request@xent.com?subject=subscribe>
List-Id: Friends of Rohit Khare <fork.xent.com>
List-Unsubscribe: <http://xent.com/mailman/listinfo/fork>,
    <mailto:fork-request@xent.com?subject=unsubscribe>
List-Archive: <http://xent.com/pipermail/fork/>
Date: Sun, 11 Aug 2002 00:57:43 -0700

Gary Lawrence Murphy writes:
> This is for the whitelist fans: Can someone please tell us why the
> following extremely frequent spam header pattern would _not_ pass a
> whitelist test?  The letter itself is most certainly spam/viral and
> was most certainly not sent by me, but I see no way you might tell
> that it was not, nor can I see how I might charge the sender with
> fraud for having 'impersonated' my account.  

If you crypto-sign your outgoing mail, you don't have to set 
your mailwall whitelist to accept unsigned mail spoofed as being 
from you. 

Similarly, if you include some weaker token or checksum that
spammers can't easily guess. 

If you can track the actual sender, then the proof that they've
committed identity fraud is your credible testimony that you
are the rightful user of the declared originating address, and
that you did not send the message. I'm not sure what level of
damages you could claim, though.

- Gordon


http://xent.com/mailman/listinfo/fork