gmane.mail.spam.hashcash

Exchange mucking with the headers

Aaron Toponce — 2011-08-31T14:47:20

I've come to the knowledge that Exchange is mucking with the mail headers,
stripping out any duplicate fields. This is troublesome for me, as sending
a mail to multiple recipients, means minting many Hashcash tokens, and
placing each token in the header with "X-Hashcash". There may be more than
one present. However, Exchange changes "X-Hashcash" to "x-hashcash", and
removes any dupe "x-hashcash" fields.

I could stamp each mail upon delivery, rather than mail creation, but that
would meach changing the way I handle SMTP with Mutt, and that's not
something I'm really interested in persuing. AFAIK, there is no "standard"
against duplicate header fields, so my multiple "X-Hashcash" tokens should
be just fine.

Has anyone else noticed this? Is there a server-side setting on Exchange
that prevents Exchange from mucking with the headers?

Thanks,

--
. o .   o . o   . . o   o . .   . o .
. . o   . o o   o . o   . o o   . . o
o o o   . o .   . o o   o o .   o o o

ways of integrating into Thunderbird

Eric S. Johansson — 2011-06-30T14:10:38

http://sourceforge.net/apps/mediawiki/attachreminder/index.php?title=Main_Page

it seems to me that we could repurpose this plug-in as a way of adding proof of 
work stamps. One potential problem might be the time it takes to generate stamps 
and how long we get in the user's way.

Have folks seen better Thunderbird plug-ins we could repurpose?

hashcash-sendmail breaks up long stamps< at >< at >sig

Andreas Mattheiss — 2011-06-28T21:30:00

Hi,

hashcash-sendmail appears to struggle with long stamps.

When i issue

hashcash -m -b20 -r andreas.mattheiss< at >xxxxx.xxxxxx.xxx

I get 

hashcash stamp: 1:20:110628:andreas.mattheiss< at >xxxxx.xxxxxx.xxx::LvM42IeOvGyF8fIY:0000000000000000000000000000v3E

(The xxx are not what was used for minting the stamp) 

So far so good. If I have hashcash-sendmail do that for me, I check the
logfile

Tue Jun 28 22:11:09 2011 hashcash-sendmail[6304]: made token X-Hashcash:
1:20:110628:andreas.mattheiss< at >xxx.xx::ZD6WiVAJVEPAJCs6:0000000000000
0000000000000000000000005QGb

This displays awkward here; in fact there are two spaces after the group
"0000000000000" and "0000000000000000000000005QGb" in the logfile; maybe
you want to try it with a slightly longish email adress and
check the logfile yourself. At least it displays like that, and there must
be something amiss, since procmail gets back to me with

------ pipe to |/overspill/sekundaer/bin/procmail /home/andreas/.procmailrc
       generated by andreas< at >localhost ------                               

examining stamp:
1:20:110628:andreas.mattheiss< at >xxx.xx::ZD6WiVAJVEPAJCs6:0000000000000
0000000000000000000000005QGb
skipped: stamp invalid
rejected: no valid stamps found
check: failed
             
Asking hashcash-sendmail for invoking hashcash with -Z 1 appears to solve
the problem; there are no spaces in the thus generated stamp in the
logfile and the procmail-recepie checks ok, but the overall length of
the stamp is uncomfortably close to where the break used to occur.

Can someone please have a look as to what may be going on there;
unfortunately I am not a perler.

Regards
Andreas

passthrough mode, feature request

Łukasz Stelmach — 2011-06-22T11:13:19

Hi.

I started using hascash quite recently and as it happens I already have
found one missing feature: passthrough mode. It is a mode of operation
found in the Bogofilter software. A programme in this mode acts as
a filter and inserts a header that holds information that can later be
used by an MDA (e.g. procmail). For example Bogofilter headers look like
these:

 X-Bogosity: Unsure, tests=bogofilter, spamicity=0.887269, version=1.1.5
 X-Bogosity: Spam, tests=bogofilter, spamicity=1.000000, version=1.1.5
 X-Bogosity: Ham, tests=bogofilter, spamicity=0.157896, version=1.2.0

Hashcash could insert X-Hashcash-Info (e.g.) for every X-Hashcash
found. The header might contain

* actual number of bits "spent"

* "double spend" test results

* stamp's age (this is redundant but makes filtering with procmail
  easier)

* all the information from the X-Hashcash except the rand and counter
  fields

The difference between X-Hashcash and X-Hashcash-Info is that the latter
can be truested by MDA during classification as it is first removed by
hashcash and then created again.

[MS-OXPSVAL]: E-Mail Postmark Validation Protocol Specification

Aaron Toponce — 2011-06-19T21:16:37

Curious if anyone has read over this, and what their thoughts are. This is
Microsoft's implementation of a proof-of-work system, similar to Hashcash
(I hesitate to call it a "derivative").

http://msdn.microsoft.com/en-us/library/cc433493%28v=exchg.80%29.aspx

From what I can tell, the protocol is covered by a royalty-based patent,
which will prevent any Free Software implementations. What I find
interesting, is the recipients, sender and subject are encoded into a
base-64 string. What's the purpose of this? base-64 encoding doesn't add
any significant time to the processing, and it's trivial to reverse getting
the original data.

Anyway, just curious.

--
. o .   o . o   . . o   o . .   . o .
. . o   . o o   o . o   . o o   . . o
o o o   . o .   . o o   o o .   o o o

hashcash on wordpress

Eric S. Johansson — 2011-06-14T17:03:13

did you know about this?

http://wordpress-plugins.feifei.us/hashcash/

Fwd: Mentor needed

Eric S. Johansson — 2011-04-16T06:34:29

What I sent

-------- Original Message --------
Subject: Mentor needed
Date: Fri, 15 Apr 2011 23:33:02 -0700 (PDT)
From: esj <esj< at >harvee.org>
To: mozilla-labs <mozilla-labs< at >googlegroups.com>

a few of us on the hashcash mailing list were talking about how we
could add proof of work postage systems at the client end.  We are
willing to do the work necessary for this effort but we're kind of
like the joke about the bachelor backwoodsman[1] and can't figure out
how to get started.  We could use a mentor to help us get oriented and
help with solving some of the problems that we may encounter.

If there is someone available to help us, please let me know or join
the hash cash mailing list hashcash< at >freelists.org and start up a
conversation.

For those with long memories, this kind of request has been made a few
times over the years but we never pushed hard asking for the kind of
help we needed. So, we really want to make this happen, we also really
need the help to get started.

--- eric

[1] the joke about the bachelor backwoodsman has him complaining to
another backwoodsman about how he can't make anything from these fancy
cityfolk recipe books. After all, they'll start out with "take a clean
plate" and that stops him right there. We do need a bit of help
getting past our equivalent of a clean plate.

about thunderbird patch...

Adam Back — 2011-04-06T16:39:11

Does anyone subscribe to the thunderbird dev list?  

Would someone be interested in subscribing and seeing if they can drum up
interest in helping with the thunderbird part of the plumbing to put
hashcash suppport into thunderbird?  (Or create a patch to do that).

Presumably this could be done via hashcash library, or just direct - its
fairly simple given access to a SHA1 library, key value store (like berkely
db etc), and mail parsing library that thunderbird will have.  Seems like
most ingredients are already in thunderbird. 

Adam

patch for mozilla thunderbird requested

Bas Steendijk — 2011-03-31T13:20:43

in the feature request to add hashcash in mozilla thunderbird,

https://bugzilla.mozilla.org/show_bug.cgi?id=229686

which currently has status "WONTFIX", after i countered the arguments that 
caused it to get that status, the following happened:

i gave argument:

"this request is not about adding the 16 MB library, but about adding 
hashcash, which is simple and can be implemented in little size."

Ludovic Hirlimann then posted:

"Please provide a patch so we can figure out how much this would add and 
then decide if we want it in the product or not."

i'm asking hereby if someone can produce a patch to add hashcash to 
thunderbird, and post on there.

Penny Red for Mutt

Aaron Toponce — 2011-03-30T23:15:39

I got everything squared away for both the minting and verification scripts
in Python. I blogged about them here:

    http://pthree.org/2011/03/24/hashcash-and-mutt/
    http://pthree.org/2011/03/29/verifying-hashcash-tokens-with-mutt/

A friend of mine suggested that I create a project out of it, seeing as
though both scripts are a bit feature stripped. So, I launched it on
GitHub:

    https://github.com/atoponce/Penny-Red

Hashcash might be dead for the rest of the world, but from what I can tell,
antispam MTA software has support for Hashcash, such as SpamAssassin, so at
least I run the higher probability that my sent mail won't end up in the
recipient's SPAM folder. Maybe during the process, I can raise a little
advocation too, and get more people using it:

    http://identi.ca/group/hashcash
    http://twitter.com/search#search?q=%23hashcash

The great thing with both Python scripts is they can be easily implemented
into other MUA software. The mint_hashcash.py script only needs to write to
your email headers, and the verify_hashcash.py script only needs to read
the mail from STDIN and write its results to STDOUT.

Anyway, thought I'd send a head's up about the project, seeing as though
I've been bugging you this far. :)

--
. o .   o . o   . . o   o . .   . o .
. . o   . o o   o . o   . o o   . . o
o o o   . o .   . o o   o o .   o o o

Python hashcash minting script for Mutt

Aaron Toponce — 2011-03-24T23:27:58

I have finalized my Python minting script for Mutt. I haven't written a
verification script yet, although that should be trivial with
$display_filter. That's next.

Anyway, the script is attached. If you wish to give it a go, here is what
you'll need to do to set it up:

Set the following varibles in your ~/.muttrc:

set editor="/path/to/mint_hashcash.py"  # required
set edit_headers="yes"                  # required
set askcc="yes"                         # recommended

The Python script calls Vim on line 10 of the script. Feel free to replace
it with your favorite editor.

A couple notes about the logic:

* Python 2.5 or later is required.
* It uses formatting of version 1 of the protocol only.
* It only mints new tokens after exiting your editor. If you add
additional emails, you will need to re-edit the mail, then quit to
mint the new tokens.
* Already existing tokens are left in place without duplicates minted.
* Both "X-Hashcash" and "Hashcash" headers are supported.
* 20 bits is minted, and compression level 2 is used.

If you use it, and find any bugs, please let me know. I've been using it
all day, and I've been trying to break it, but haven't found anything yet.

--
. o .   o . o   . . o   o . .   . o .
. . o   . o o   o . o   . o o   . . o
o o o   . o .   . o o   o o .   o o o

Hashcash and Bcc/envelope recipients

Aaron Toponce — 2011-03-23T21:24:17

I've built a Python script for Mutt that mints tokens based on the
addresses in the To: and Cc: fields, however, how does hashcash handle Bcc:
or envelope recipients? By putting a token for each recipient in the
header, the addresses of those recipients would be revealed, thus
defeating the whole point.

I've thought about minting a token with a resource of "bcc-recipients", and
placing that token in the headers, but then that reveals that there have
been Bcc: recipients added to the mail. I believe the whole point of Bcc:
is to be completely transparent, not revealing to anyone that they exist.

So, I'm guessing that it's probably best to just ignore Bcc: and envelope
recipients in general. I guess I could mint a token for the From: address
(is this what I should be doing anyway?), but then that begs the question
of why not just minting a token using the From: address only, and not worry
about the To: and Cc: addresses?

Am I missing something?

--
. o .   o . o   . . o   o . .   . o .
. . o   . o o   o . o   . o o   . . o
o o o   . o .   . o o   o o .   o o o

Using hashcash with Mutt and Vim

Aaron Toponce — 2011-03-21T21:38:56

I would like to tie hashcash into Mutt. I've checked out
http://hashcash.org/mail/mua/mutt/, however I'm already using a custom
sendmail command, so the hashcash-sendmail command won't work for me,
and Tim Ruddick's foreground hashcash filter Perl script has no
documenation on how to tie it into Mutt. I've even emailed Tim, with no
response back.

So, I figure I can create my own hack on getting hashcash into Mutt.
Here's what I've come up with so far:

    * In my ~/.muttrc, I've added "set edit_headers=yes"
    * My default editor is Vim, so I can run ":read !hashcash -m foo -X
      -Z 2" to put the token into the header.

I would like to automate the process of adding the token, rather than
doing it manually. Because I have access to "To:", "Cc:" and "Bcc:" in
the header, I should be able to write a Vim macro to parse the
comma-separated list of email addresses in those fields, and create the
appropriate token for each address found, and place the token in the
header.

Of course, this is just for minting tokens. I still need a method for
verifying tokens with Mutt. Help with that will be appreciated too.
Also, care needs to be taken with the "Bcc:" addresses, so the tokens
are present for each mail, but don't reveal the addresses to the other
recipients of the mail. Maybe I should just ignore "Bcc:", even though
that is a massive tool for spammers.

Any help would be appreciated.

Thanks,

Bug in Debian

Aaron Toponce — 2011-03-21T21:31:14

I submitted a the following bug to the Debian bug tracker:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=619183

Does anyone else have the same problem, or am I doing it wrong? For
example:

    $ hashcash -m foo -b 30 -Z 2
    hashcash token: 1:20:110321:foo::D98FQryEx9gxON+9:82nc

It is no 30 bits, as the 2nd field shows, and verifying it with SHA1
shows such:

    $ echo -n 1:20:110321:foo::D98FQryEx9gxON+9:82nc | sha1sum
    00000b8fc2f1b82dbda883499d9ed9c8e30f130e  -

Has anyone else seen this problem?