Rating:

11/19/02

Stopping Spam Related Computer Disasters

"I'm mad as hell, and I'm not going to take this anymore!" says newscaster Howard Beale, the "mad prophet of the airwaves", in the movie Network.

Which describes exactly how we all feel about spam.

My ISP, BellSouth, provides a spam filtering tool called Mailguard (their licensed version of BrightMail) and it only filters out about a small percentage of the spam I receive. Supposedly, the program "learns" when you forward a spam message to a special BellSouth e-mail address (this_is_spam@bellsouth.net) but I've not seen any evidence that this has helped - I still receive the same spam over and over again.

In addition to Mailguard / BrightMail, I have dozens of message rules set up in Outlook Express, each designed to filter out a certain type of spam. (That's right, folks - if you send me an e-mail with any reference to male or female genitals in the text, it gets deleted automatically.)

And still the spam comes in ever increasing volume and vulgarity. I've seen pictures of body parts I swear I didn't even know existed. I've seen messages promising to enlarge body parts that are too small and reduce body parts that too large.

The fact is, you can set up a million message rules, and you can use third party rule-based spam filtering software, but you still won't be able to stop the spam.

The problem with rule-based spam killers is that they assume that all e-mail is good unless proven otherwise, and they are all imperfect at discerning the good from the bad. So much so that I still get hundreds of spam message a week, in spite of having Mailguard / BrightMail as a first line of defense and message rules as a second line of defense. But that's not all - a rule based solution may block some messages that should be allowed through because something in a legitimate message matched a rule.

And the spammers keep getting smarter and slimier. For example, message rules don't work anymore because more and more spammers are encapsulating their entire message in an image. Message rules are helpless against images. All you can do is try to filter out spam based on the message subject, and spammers are adept at crafting subject headers that make it difficult for you to do this without filtering out legitimate e-mail messages.

Spam and Computer Disasters

Many of the spam messages that slip through - dozens each week - contain computer viruses. Although my Norton AntiVirus has kept my computer from getting infected thus far, there is always the chance that some new virus - one that I am not inoculated against because it is so new and has spread so fast that Norton does not yet afford protection - might slip past Norton's defenses and infect my computer. 

So spam is not just an inconvenience; not just an intrusion on your privacy and a waste of your precious time. Spam can be the direct cause of a virus related computer disaster, and an effective spam killer is an essential disaster prevention tool. (Not to mention the fact that many spam messages are also scams, designed to steal your money as well as your time.)

Stopping Spam: Permission Based E-Mail Managers

My search for an effective spam blocker led me to conclude that the only way to stop spam in its tracks is to use an application that assumes every e-mail message is spam until proven otherwise. And for that, you need a product like DigiPortal Software's ChoiceMail.

ChoiceMail is a permission based e-mail management system.. All incoming email is assumed to be spam until senders have obtained permission (called registering) to send you email. Until they register, mail from unapproved senders will not appear in your email client (application).

Unapproved senders are automatically offered the opportunity to register. If they do so you are notified so that you can choose to approve (or not) all future emails from that sender. Since the registration process requires manual intervention on the part of the sender, and since most spam comes from automatic spamming systems, you seldom if ever receive a request for approval from a spammer.

ChoiceMail: Questions and Answers

When I first stumbled across ChoiceMail, I had a number of concerns about using a permission based spam killer, and I bet you do too. Fortunately, I was able to find all of the answers to my questions in ChoiceMail's well-written documentation, which can be downloaded from DigiPortal's web site. I will tell you exactly how ChoiceMail works in due course, but first I want to allay your concerns, because unless I address these concerns to your satisfaction, you probably couldn't give a darn how it works. So here are the questions I had, along with the answers I found.

I have hundreds of people in my address book already. Are each of these people going to have to request approval to send me messages?

No. When you install ChoiceMail, you can import your address book so that everyone in it becomes an approved sender:

During the import process, you can review the list to decide whether you want to import individual entries. (ChoiceMail recommends that you clean up your address book first to simplify the process.)

I often send e-mails to people who are not in my address book, and are not approved senders. If they reply to my e-mail, are they going to have to register as an approved sender?  This would be a major annoyance.

No. ChoiceMail will automatically approve someone you send a message first (you can turn this option off if you like.). You can also select  options to also automatically approve everyone on a CC list or BCC (blind carbon copy) list:

Thus, if you sell something on eBay, you can contact the winner of the auction, and you will be able to receive their reply without requiring the buyer to register. 

I have a lot of friends at Hewlett Packard, and I never receive any spam from hp.com. Do each of my friends at Hewlett Packard have to register?

No. You can easily create a rule that allow all messages from a specified domain to be pre-approved. However, I would advise you to use this feature judiciously. You might want to pre-approve all messages from hp.com, but you would certainly not want to pre-approve all messages from yahoo.com,  hotmail.com, or aol.com - three favorite domains of spammers.

I am concerned that people will not fill out the registration form and that I will not receive important messages.

I first became aware of ChoiceMail because I received a registration message when I tried to send an e-mail to a ChoiceMail user. It took me all of about 20 seconds to register, and I did not find the process to be onerous. Of course, I really wanted to communicate with this person. It was important that my message get through, so I didn't mind taking the time to register. I suspect that if it is important for somebody to get through to you, they will do the same.

I'm not convinced. I am still concerned that I won't see an important message.

Fear not. ChoiceMail stores messages that are pending registration in suspense in a special folder on your computer. The messages are stored outside of your e-mail application, but you can preview them through the ChoiceMail user interface and accept them if you wish. (ChoiceMail calls this the Unknown Senders view.)  ChoiceMail is designed so that if you preview a message, you are not exposed to any viruses the message may contain. Messages from unknown senders are stored for three days and then automatically deleted. You can change this length of time in the program setup options.

If an unapproved sender sends me several e-mails at once, won't he get inundated with registration requests? 

No. ChoiceMail keeps track of open registration requests. An unapproved sender will only receive one request, so you don't have to worry about annoying  legitimate correspondents with multiple registration requests.

How ChoiceMail Works: A Brief Technical Perspective

ChoiceMail positions itself between your e-mail application, for example, Microsoft Outlook or Outlook Express, and your Internet Service Provider's mail servers:  

.

Basically, ChoiceMail creates a local mail server on your computer that sits between your Internet Service Provider's mail server and your local e-mail application (client). The ChoiceMail mail server retrieves e-mail messages from your ISP's mail server. Messages from approved (whitelisted) senders are allowed through to your e-mail application. Messages from unknown senders are held in suspense pending the registration and approval process. Messages from blacklisted senders are silently deleted. If you have multiple e-mail accounts on one computer, all e-mail accounts can be routed through ChoiceMail.

(For those of you who are quite technically inclined, ChoiceMail will work with any email application that supports the POP3 protocol. ChoiceMail can talk to any POP3 system, including those that require authentication or secure password authentication.)

How ChoiceMail Works: A User's Perspective

When an unknown sender sends you a message, ChoiceMail intercepts the message and sends a reply to the sender asking him to register. You can use the standard ChoiceMail message (below) or you can customize the message in ChoiceMail's setup options.

The sender is directed to a web page (below) where he must fill in some information (his name and reason for wanting to contact you and a special code). This process is sufficient to stop spam because spammers' automated systems cannot respond to the registration request. (In fact, the registration request never makes it to most spammers, because the return address on spam mail is usually a fake address.) The requirement to enter a special code prevents spammers from creating an autoresponder that will automatically respond to the registration request.

Once the user has registered, you will receive a popup window telling you who is trying to contact you, and why:

You can approve the registration in which case the original message that the sender sent is released to your e-mail application. The sender is put on your white list and all future messages from that sender will be automatically approved. The sender is automatically sent a message indicating that he or she is now approved. 

If you select Reject, the sender is placed on your black list and all messages from that sender are silently deleted. The sender is not informed. If you really want the sender to know that you are rejecting his or her messages, use Reject (Explain) instead. (I personally can't imagine a situation where I would use this feature.)

If you delete the sender, then it is as if the sender was never seen before. Blocked messages are deleted and if the sender sends you another message, he or she will get another registration request.

Installing and Configuring ChoiceMail

ChoiceMail provides an easy to use wizard to help you install and configure the product. The wizard takes you through the process of importing your address book, setting up your e-mail client so that it can communicate with the ChoiceMail proxy server, and setting up ChoiceMail so that it can communicate with your Internet Service Provider's mail server. (Should you decide to uninstall ChoiceMail, the uninstall program automatically restores your original e-mail settings.)

You can manually pre-approve a sender. For example, if you know that you will be getting emails from john@smith.com, you can manually pre-approve this e-mail address so John does not receive a request to register.

And, as mentioned earlier, you can configure ChoiceMail to automatically pre-approve anyone that you send a message to, so that the person who replies will not be required to register.

You can configure ChoiceMail with rules that automatically approve or block mail from certain domains. For example, I get a lot of mail from Korea, and it is all spam, so I just block all messages coming from .kr.  (You also have the ability to override such rules for specific senders within a domain.)

You can even establish more flexible rules to handle unusual situations. DigiPortal says that it is not normally necessary to add specific e-mail rules as the combination of your pre-approved sender list and automatic approval of senders to whom you send messages is usually sufficient. However, I have already found one instance where a message rule was invaluable to me. I sell merchandise elsewhere on this web site, and when somebody buys something, I receive an automatic e-mail notification of payment from the buyer through my merchant services provider. I certainly wouldn't want to offend somebody who just bought something by requiring him to register in order to tell me that he sent me money. To solve this problem, I have a message rule that accepts these e-mail payment notifications based on the message subject.

Reinstalling ChoiceMail. In case you are wondering (I did!), it is very easy to migrate your ChoiceMail data (white list, black list, rules, settings and preferences, etc.) to a new computer when you replace your tired old Windows 98 system with a Windows XP computer. Simply reinstall ChoiceMail on your new machine and copy the contents of your old ChoiceMail folder (including its subfolders) to the new machine.

Compatibility

ChoiceMail works on all Windows based personal computers. The current version of ChoiceMail works with all popular e-mail applications (clients), including Microsoft Outlook, Outlook Express, and Eudora.

The next release of ChoiceMail will be compatible with web based email systems, such as AOL, Hotmail, Yahoo Mail, and MSN, provided that you are willing to run an email client on your computer. (ChoiceMail downloads the messages from the web based e-mail system to your computer. You will also be able to compose mail on your local e-mail application and send it back through AOL, Hotmail, etc. Which means that you don't have to put up with AOL's e-mail interface anymore!)

ChoiceMail is compatible with antivirus software and firewall software. If you have a firewall such as Zone Alarm, you will get a program alert the first time you run ChoiceMail, just as you do the first time you run any application that accesses the Internet. (Tech talk: if you are using Zone Alarm, you will need to grant ChoiceMail server privileges. If you aren't using Zone Alarm, you probably won't understand what I just said and don't need to care.)

If you have an older version of Norton AntiVirus (2001 or earlier), you will have to perform some extra steps to configure ChoiceMail. This is due to the fact that older versions of Norton AntiVirus setup an e-mail proxy server to scan incoming e-mail messages for viruses and may conflict with the ChoiceMail setup. It is easy to work around this issue. However, if you are using an older version of Norton AntiVirus, I urge you to purchase and install the newest version to maximize your protection against viruses.

Misconceptions And Misinformation About ChoiceMail

As is the case with any new product, there is a certain amount of misinformation about ChoiceMail in the marketplace.

Kim Komando did a review of ChoiceMail on her web site. In her review, she stated that "There is one slight issue with ChoiceMail, though. It opens the e-mails to check for addresses and rules checking. When you open the e-mail viruses can fire (I got hit with the Klez virus). Luckily, I have NAV 2002 running and did not get stung."  

I have spoken with David Jameson, founder of DigiPortal Software, and he has assured me that the review is incorrect.. ChoiceMail does not examine your e-mail messages in any way that could possible cause a virus to deliver its payload. In fact, just the opposite is true. ChoiceMail will keep many virus laden e-mail messages from ever being received by your e-mail applications. Most of the computer viruses that are send to me arrive from unapproved senders. These senders would be required to register, which they would not do, and in time their message would be automatically deleted. 

And just recently, on 11/18/02, information technology columnist Fred Langa said this about ChoiceMail in the Langa Letter forum:

 "This approach can work great for one-to-one communication, but it fails for valid one-to-many communication.

For example, each time I publish a new issue of my newsletter, I get *hundreds* of these "click to go to a web site and fill in a magic password" or "click to go to a web site and write a short note explaining why you want to communicate with me..." emails.

I can't and don't respond to these--- there just isn't time to arrange for what amounts to individual delivery arrangements for large numbers of readers. As a result a number of readers don't get the newsletters they've asked for--- and in some cases, paid for.

This seems to be to be a self-defeating way of handling spam, as it almost surely will block ANY mass-mailed item--- virus bulk items, newsletters, news services, etc.--- that you've signed up for."

Of course, Fred is incorrect, and you probably realize that having read this review. It wasn't long before someone responded with the correct information:

"The end user can solve this problem by setting ChoiceMail to accept all emails from your domain and they will never miss a newsletter. So if you are getting these registration requests, it's because the person no longer wishes to receive mail from your domain or they have not configured their ChoiceMail properly.  I never miss any of my newsletters from American Airlines, United Airlines, the Wall Street Journal, selected software companies, etc, because my ChoiceMail has been configured to accept them."

ChoiceMail: A Serious Tool for Serious Problems

In the movie The American President, Michael Douglas says, "We have serious problems to solve, and we need serious people to solve them." In a similar vein, ChoiceMail is a serious application for serious spam problems. If you only get a few spam messages a day, ChoiceMail is overkill (unless of course the messages are offensive in nature, in which case one message may be too many - you be the judge). If, on the other hand, you get hundreds of spam messages each week, the only viable solution  is a permission based e-mail management such as ChoiceMail. 

ChoiceMail provides the additional side-benefit of protecting your computer from new computer viruses that originate from unknown senders, and as such is an effective disaster prevention tool as well as a spam killer.

I wish it were a kindler, gentler world, where one did not have to go to such extremes to stop these constant intrusions into our privacy. But it isn't. In fact, while you were sleeping, this woman sent out a few million more spam messages. What she is doing is legal, but as my brother is quick to point out, it is also legal to break wind in an elevator, but it still stinks.

I foresee a time in the near future when most people will be using permission based e-mail systems. Now if only somebody would invent a permission based phone system to stop all of the telemarketers while allowing approved callers through!

Buying or Trying

ChoiceMail sells for $39.95 and can be downloaded from DigiPortal's web site. DigiPortal gives you the option of downloading a trial version. The trial version is good for 14 days and is the complete, full featured product. If you decide to purchase the product after the trial period, you do not delete (uninstall) from your system and reinstall it - that would be silly, as you would have to reconfigure ChoiceMail if you did. Instead, you simply install the version you purchase over the trial version.

Click here to try or buyChoice Mail.

 

Top of Page     Home –PC Fear Factor      Back To Product Reviews      Buy PC Fear Factor      www.alanluber.com