* DigiPortal Software lays out case for challenge/response
I had an interesting discussion last week with a couple of senior people at DigiPortal Software, the makers of ChoiceMail, a challenge/response anti-spam system that works with a wide variety of e-mail clients and provides a variety of capabilities.
These gentlemen offered the following assertions:
* About 99.8% of the legitimate e-mail the typical user receives is from someone the user already knows, meaning that only about one message in 500 legitimate messages is from someone with whom the recipient is not familiar. If we assume that 80% of all e-mail is spam, this means that only about one message in every 2,500 messages received would be from a legitimate sender that is unknown to the user.
* While many believe that a challenge/response mechanism imposes an undue burden on new e-mail senders, this is actually just a myth, since the average user would challenge a legitimate sender only about once every two weeks, given typical e-mail volumes. The total “burden” on senders and recipients, therefore, would be about 30 seconds per month.
The bottom line for their argument is this: Because the vast majority of messages received by the typical e-mail user would not involve a challenge (the recipient already knows the user), and because spammers cannot respond to a challenge because their systems are automated, the hundreds of millions of dollars that are spent on anti-spam technology by enterprises, service providers and consumers are actually spent simply to detect the approximately 0.04% of legitimate e-mail that is new to an e-mail recipient. DigiPortal contends that if challenge/response were the primary mechanism used to eliminate spam, the typical user would achieve virtually 100% accuracy in spam detection and that spam would simply disappear because it would never get through to the end user.
Clearly, there are some e-mail users for which challenge/response is not all that useful, such as technical support representatives, marketing people and others that receive large numbers of messages from legitimate, but previously unknown, senders. However, I believe that there is some merit to DigiPortal’s argument for most users. I’d like to hear your response to it – please drop me a line at mailto:michael@ostermanresearch.com
