5 ms·

Port 25 will be blocked for South Korea from December

104 points by Tsagadai 15y ago

hutler 15y ago
Same decree issued by telco authority here in Finland. Nice combo with the mandatory data retention laws (must use isp mail servers + isp must keep and hand out logs to authorities).
- marvin 15y ago
  That's actually pretty sinister. I'm in Norway, and although there hasn't been any push to centralize and consolidate the e-mail servers in the name of spam, the EU data retention directive was passed here in April after lots of resistance. I hoped that our neighbors were in a better position to fight these attacks on liberty online. Is privacy on the web really under this much pressure in Finland?
  - mike-cardwell 15y ago
    You may consider it sinister, but it's a fairly common practice all over the World for residential ISPs.
    - Daniel_Newby 15y ago
      "Must use archiving ISP mail servers" is sinister.
      - mike-cardwell 15y ago
        "Potentially troubling" maybe. I see no evidence that their motives are sinister.
      - baudehlo 15y ago
        Email is a postcard, not a securely sealed envelope. If you want it to be securely sealed use PGP, then the archiving doesn't matter.
  - haakon 15y ago
    Finland is pretty bad when it comes to these things. They block political criticism against its web censorship policy: https://secure.wikimedia.org/wikinews/en/wiki/Finnish_internet_censorship_critic_blacklisted https://secure.wikimedia.org/wikinews/en/wiki/Finnish_intern...
- vitalysh 15y ago
  I'm on Sonera network at home and able to use port 25. Although at work Elisa blocks it, so I guess it is per ISP basis.
  - hutler 15y ago
    Interesting. Other people are reporting on their forums that port 25 is allowed only to their own mail servers (http://www5.sonera.fi/keskustele/viewtopic.php?f=57&t=102 http://www5.sonera.fi/keskustele/viewtopic.php?f=57&t=10... ). More similar references are easily found using google.
    - vitalysh 15y ago
      I'm on HOAS(provided by Sonera) network, I guess maybe thats why.
alexchamberlain 15y ago
IMHO The best way to reduce spam is to identify the problems in the current incarnation of email and design a new system that takes such problems into account.
- jbert 15y ago
  Well, the same problems apply to postal mail, IM and phone calls, etc. I think the two properties which a comms method needs to have a spam problem are: 1) it is inexpensive to communicate with someone 2) it is has a fixed, human-memorable "address" which can be communicated out of band (business card, verbally etc) Once you have these two things, such lists of fixed address can accumulate and be circulated - and they can be spammed. (2) implies that your comms method accept comms from unknown people. (1) is necessary for spammers to bother to do to use that channel to communicate with you. I think you have to give up one or the other of these things to avoid spam. Note that (1) is a sliding scale. Physical post is significantly more expensive than email to send, and suffers less spam - but it is not non-zero. Basically if cost of "customer acquisition" < "cost to send spam" on that comms channel, then you'll get some (if (2) is met). [*] I suppose some heuristics to decide if it is OK for "random unknown user X" to contact me can help. But false positives are the very devil here...
  - deleted 15y ago
    [deleted]
  - alexchamberlain 15y ago
    Why can't I be asked the first time someone communicates with me? (This is ofc client-side spam prevention, but it should be passed upstream ideally) However, this isn't necessary for all communications. For instance, if a communication is signed by a reputable company (bank, for instance), then don't bother asking. ISPs should keep the list of reputable companies as short as possible and, regardless, it gets rid of phishing emails.
    - mike-cardwell 15y ago
      If people see a message saying "x has tried to contact you, do you wish to allow them", some of them will say yes. So spammers will continue to spam just as hard as they always have. Also, considering how easy it would be to spoof "x", they could probably make people click "yes" a significant amount of the time.
chrislomax 15y ago
Would a better alternative not be to not allow insecure mail servers? Why don't mail server providers disallow their programs from being open relays or have IP/Username and password restrictions in place. I configured our mail server to only accept mail from our internal work IP address and from authorised users. Obviously mass mail providers will only be able to impose a username and password restriction but I would say the best way is to stop people producing mail software that can be open.
- pferde 15y ago
  I configured our mail server to only accept mail from our internal work IP address and from authorised users. So if one of your office PCs catches an e-flu, it will have no trouble using your mailserver to spread spam. The way I see it, the only way is to make SMTP authentication mandatory _everywhere_ (except perhaps on your desktop localhost, which should accept mail from you, but should be required to authenticate when pushing your outgoing mail to your upstream mailserver).
  - apgwoz 15y ago
    So that if one of your office PCs gets compromised the SMTP authentication is also compromised, and therefore you have the same problem. This is assuming you don't require that someone type their password everytime they send a message--that'd be ridiculous.
    - pferde 15y ago
      Yes, I imagine there is malware out there which can read smtp credentials from an infected host, but majority can't, and will just try sending out without authentication. If nothing else, resulting amount of spam is decreased severely. OTOH, if smtp auth became mandatory, or at least widely used, malware would just adapt, and its ability to sniff out credentials would improve. Arms race and all that. So scratch my idea.
  - chrislomax 15y ago
    It stops our mail server from being used as an open relay though? How does blocking 1 specific port stop the issue anyway? They can just change the port they connect on? As stated in the actual article... Do these government agencies actually think blocking port 25 will reduce spam? Most of the issues stem from open relays. I was offering an opinion on how to resolve those issues. Changing which port accepts the mail is in my opinion pointless. It's like saying that most burglars come in through the back door so the government blocks everyones back door, they will just come in the front.
mike-cardwell 15y ago
http://www.postcastserver.com/help/Port_25_Blocking.aspx http://www.postcastserver.com/help/Port_25_Blocking.aspx ISPs that block Port 25 This list contains some of the major ISPs that block port 25 on their servers: AT&T (can be unblocked at the request) MindSpring BellSouth MSN CableOne NetZero Charter People PC Comcast ATTBI Sprynet Cox Sympatico.ca EarthLink Verio Flashnet Verizon MediaOne I don't know how accurate or up to date this list is, but I know that loads of residential ISPs in countries all over the World block outgoing port 25.
- alexchamberlain 15y ago
  I think this is irrelivant. Don't these ISPs still run SMTP servers on port 25, but they force you to use theirs? Their SMTP servers then contact other SMTP servers on port 25 to actually deliver the mail.
  - mike-cardwell 15y ago
    Yes they do. And thus botnets are forced to route via the ISPs intermediary server instead of making a direct connection to the recipient mail server. That intermediary server can apply rate limiting and blocking. ISPs who implement blocks on port 25 and force everyone to use their mail server are able to take responsibility for the spam leaving their network. Note, ISPs don't block ports 587 and 465, so they're not preventing you from using services like GMail etc. Also, it is completely relevant as they have all done exactly what is being proposed in the article being discussed. ISPs in South Korea will also provide mail relays for their subscribers to use.
    - alexchamberlain 15y ago
      But this is really easy to work around. Isn't the Soth Korea arguing that all mail relays should block port 25, not just those on residential networks?
      - mike-cardwell 15y ago
jaequery 15y ago
it's a good idea. but scary to think what govt can't do.
- astrodust 15y ago
  Blocking port 25 doesn't impact people in a meaningful way, only spammers. For years virtually every ISP has offered an alternate port like 587.

104 points by Tsagadai 15y ago

Same decree issued by telco authority here in Finland. Nice combo with the mandatory data retention laws (must use isp mail servers + isp must keep and hand out logs to authorities).

marvin 15y ago
That's actually pretty sinister. I'm in Norway, and although there hasn't been any push to centralize and consolidate the e-mail servers in the name of spam, the EU data retention directive was passed here in April after lots of resistance. I hoped that our neighbors were in a better position to fight these attacks on liberty online. Is privacy on the web really under this much pressure in Finland?
- mike-cardwell 15y ago
  You may consider it sinister, but it's a fairly common practice all over the World for residential ISPs.
  - Daniel_Newby 15y ago
    "Must use archiving ISP mail servers" is sinister.
    - mike-cardwell 15y ago
      "Potentially troubling" maybe. I see no evidence that their motives are sinister.
    - baudehlo 15y ago
      Email is a postcard, not a securely sealed envelope. If you want it to be securely sealed use PGP, then the archiving doesn't matter.
- haakon 15y ago
  Finland is pretty bad when it comes to these things. They block political criticism against its web censorship policy: https://secure.wikimedia.org/wikinews/en/wiki/Finnish_internet_censorship_critic_blacklisted https://secure.wikimedia.org/wikinews/en/wiki/Finnish_intern...
vitalysh 15y ago
I'm on Sonera network at home and able to use port 25. Although at work Elisa blocks it, so I guess it is per ISP basis.
- hutler 15y ago
  Interesting. Other people are reporting on their forums that port 25 is allowed only to their own mail servers (http://www5.sonera.fi/keskustele/viewtopic.php?f=57&t=102 http://www5.sonera.fi/keskustele/viewtopic.php?f=57&t=10... ). More similar references are easily found using google.
  - vitalysh 15y ago
    I'm on HOAS(provided by Sonera) network, I guess maybe thats why.

alexchamberlain 15y ago

IMHO The best way to reduce spam is to identify the problems in the current incarnation of email and design a new system that takes such problems into account.

jbert 15y ago
Well, the same problems apply to postal mail, IM and phone calls, etc. I think the two properties which a comms method needs to have a spam problem are: 1) it is inexpensive to communicate with someone 2) it is has a fixed, human-memorable "address" which can be communicated out of band (business card, verbally etc) Once you have these two things, such lists of fixed address can accumulate and be circulated - and they can be spammed. (2) implies that your comms method accept comms from unknown people. (1) is necessary for spammers to bother to do to use that channel to communicate with you. I think you have to give up one or the other of these things to avoid spam. Note that (1) is a sliding scale. Physical post is significantly more expensive than email to send, and suffers less spam - but it is not non-zero. Basically if cost of "customer acquisition" < "cost to send spam" on that comms channel, then you'll get some (if (2) is met). [*] I suppose some heuristics to decide if it is OK for "random unknown user X" to contact me can help. But false positives are the very devil here...
- deleted 15y ago
  [deleted]
- alexchamberlain 15y ago
  Why can't I be asked the first time someone communicates with me? (This is ofc client-side spam prevention, but it should be passed upstream ideally) However, this isn't necessary for all communications. For instance, if a communication is signed by a reputable company (bank, for instance), then don't bother asking. ISPs should keep the list of reputable companies as short as possible and, regardless, it gets rid of phishing emails.
  - mike-cardwell 15y ago
    If people see a message saying "x has tried to contact you, do you wish to allow them", some of them will say yes. So spammers will continue to spam just as hard as they always have. Also, considering how easy it would be to spoof "x", they could probably make people click "yes" a significant amount of the time.

chrislomax 15y ago

Would a better alternative not be to not allow insecure mail servers? Why don't mail server providers disallow their programs from being open relays or have IP/Username and password restrictions in place. I configured our mail server to only accept mail from our internal work IP address and from authorised users. Obviously mass mail providers will only be able to impose a username and password restriction but I would say the best way is to stop people producing mail software that can be open.

pferde 15y ago
I configured our mail server to only accept mail from our internal work IP address and from authorised users. So if one of your office PCs catches an e-flu, it will have no trouble using your mailserver to spread spam. The way I see it, the only way is to make SMTP authentication mandatory _everywhere_ (except perhaps on your desktop localhost, which should accept mail from you, but should be required to authenticate when pushing your outgoing mail to your upstream mailserver).
- apgwoz 15y ago
  So that if one of your office PCs gets compromised the SMTP authentication is also compromised, and therefore you have the same problem. This is assuming you don't require that someone type their password everytime they send a message--that'd be ridiculous.
  - pferde 15y ago
    Yes, I imagine there is malware out there which can read smtp credentials from an infected host, but majority can't, and will just try sending out without authentication. If nothing else, resulting amount of spam is decreased severely. OTOH, if smtp auth became mandatory, or at least widely used, malware would just adapt, and its ability to sniff out credentials would improve. Arms race and all that. So scratch my idea.
- chrislomax 15y ago
  It stops our mail server from being used as an open relay though? How does blocking 1 specific port stop the issue anyway? They can just change the port they connect on? As stated in the actual article... Do these government agencies actually think blocking port 25 will reduce spam? Most of the issues stem from open relays. I was offering an opinion on how to resolve those issues. Changing which port accepts the mail is in my opinion pointless. It's like saying that most burglars come in through the back door so the government blocks everyones back door, they will just come in the front.

mike-cardwell 15y ago

http://www.postcastserver.com/help/Port_25_Blocking.aspx http://www.postcastserver.com/help/Port_25_Blocking.aspx ISPs that block Port 25 This list contains some of the major ISPs that block port 25 on their servers: AT&T (can be unblocked at the request) MindSpring BellSouth MSN CableOne NetZero Charter People PC Comcast ATTBI Sprynet Cox Sympatico.ca EarthLink Verio Flashnet Verizon MediaOne I don't know how accurate or up to date this list is, but I know that loads of residential ISPs in countries all over the World block outgoing port 25.

alexchamberlain 15y ago
I think this is irrelivant. Don't these ISPs still run SMTP servers on port 25, but they force you to use theirs? Their SMTP servers then contact other SMTP servers on port 25 to actually deliver the mail.
- mike-cardwell 15y ago
  Yes they do. And thus botnets are forced to route via the ISPs intermediary server instead of making a direct connection to the recipient mail server. That intermediary server can apply rate limiting and blocking. ISPs who implement blocks on port 25 and force everyone to use their mail server are able to take responsibility for the spam leaving their network. Note, ISPs don't block ports 587 and 465, so they're not preventing you from using services like GMail etc. Also, it is completely relevant as they have all done exactly what is being proposed in the article being discussed. ISPs in South Korea will also provide mail relays for their subscribers to use.
  - alexchamberlain 15y ago
    But this is really easy to work around. Isn't the Soth Korea arguing that all mail relays should block port 25, not just those on residential networks?
    - mike-cardwell 15y ago

jaequery 15y ago

it's a good idea. but scary to think what govt can't do.

astrodust 15y ago
Blocking port 25 doesn't impact people in a meaningful way, only spammers. For years virtually every ISP has offered an alternate port like 587.