Permission Keys Adrian E. McElligott

What have you lost today? What has your Spam filter lost today?

Are spam filter false positives a problem? … “Sure communication is unreliable – get over it.” But what if we could avoid the… –frustration –time wasted –user support costs –lost of disenfranchised users –the cost of the lost messages themselves? what if, as Spam filter providers, we could avoid the… –professional embarrassment –humiliation –Damage to our brand and reputation, of having our filters mistake’s highlighted to our users?

Easiest lost message to avoid Fear of this type of lost message is the most common reason for a user to frequent their Spam folder. First Contact Replies Solicited Bulk Types of Lost Messages Least Likely to be discovered and manually recovered. Often brings new business Injury to user is great. Often incorrectly reported as Spam Damages user conference in their spam filter Annoying, disenfranchising

The real cost of lost messages New Term: Lost Message RateLost Message Rate Lost messages erode the value of a Spam Filter. Exposing a user to spam in their junk folder is still exposing the user to Spam. If the user is routinely checking their junk folder then the filter is of diminished value.

Introducing Permission Keys Permission Keys (EPK) - are a unique key that is embedded in an address in such a way that it is likely to be retained during normal use, and is therefore available to be extracted at a later date when that address is used to send a message back to the original user. works with the existing Internet infrastructure requires no modification to existing third party processes

What do Permission Keys look like? unique code or key that is embedded in to an address embedded in such a way that it is likely to be retained during normal use of that address works with the existing Internet infrastructure requires no modification to existing third party processes "John Smith " "John Smith

Key (Binary Code) CaseKeys Hybrid combinations Display Name Addressing Plus Addressing Types of Permission Keys

Types of Permission Keys - Tagged Addressing Tagged Addressing, (Plus or Minus Addressing) is appending a key to the local part of an address via standard tagged addressing. most appropriate for ‘typed-in addresses’ – business cards, off-line advertising etc. A typical Plus Addressing key may look something like this: where is the key.

Types of Permission Keys - CaseKeys CaseKeys are a type of permission key that use the CAsE of the LeTTerS that make up an address to embed a unique key into every instance of that address. A typical CaseKey might look like this:

Types of Permission Keys - Display Name Addressing (DNA) A “Display Name Addressing” Key, is a type of permission key that appends or encodes a unique key within the Display Name portion of the address. A typical display name key may look something like this: "John Smith " where is the key.

Types of Permission Keys - DNA/CaseKey Hybrid A DNA/CaseKey Hybrid key is a DNA key with a CaseKeyed representation of the protected user’s address included in both the Display Name part of the address and the “addr-spec address” - it is used in outgoing messages when tagged addressing is not supported. It may look like this – "John Smith typically automatically inserted in to all instances of the protected user’s address in all out-going messages.

Types of Permission Keys - Tagged Addressing/CaseKey Hybrid is a combination of the Plus Addressing and CaseKey methods. It is essentially a Tagged Addressing Key that has been CaseKey encoded. It may look like this – joHN.SmiTH typically manually issued to a user via a user interface for use on web forms

Permission Key Issuing Facilities New Permission Keys are randomly generated and issued from a key issuing facility There are three different types of key issuing facilities, each capable of issuing different forms of keys, and each positioned to reduce one or more types of false positives

The type of issuing facility that originally issued the key The time that the key was issued The address of the recipient, or where the key was published Identify Issuing Event Who How When How Permission Keys Work

How Permission Keys Help Match an incoming with an issuing event Identify messages mistaken for spam Improves User Confidence in their Spam Filter

How Permission Keys help user feedback dependant filters Provides automated “is not spam” feed back to the filter. Reduces User Trust Oscillation.

How Permission Keys Help DNSBL Filters In systems that use DNSBL Permission Keys allow the use of a more aggressive list criterion thereby maximizing the proportion of messages that can be blocked at the SMTP Gateway. Permission Keys in either the SMTP envelop or the message headers can be used to identify legitimate messages before the entire message has been read from the wire.

Why they will use it Permission Keys provide significant benefits to the end user, which include: Dramatically reducing a users exposure to spam. Reclaiming time that is currently lost by the user reviewing their Spam folder and looking for lost messages. Restoring confidence, alleviating fear, frustration and spam related stress. Optionally the user can be alerted each time that a lost message is found – reassuring the user that the system is working and maintaining the perceived value of the system form a user’s perspective.

Permission Keys System Components Client Side Outbound Message Key Insertion Function Spam Folder Monitoring Module Server Side Key Issuing Facility –AJAX Web Service –UI for manual issuing –Key Custodian API GetKey IsValidKey InvalidateKey Access authentication Key Generation Key Storage & Retrieval Reporting

The Global Key Custodian Dynamic Web tags Corporate Spam Filters ISP Network Filters Desktop Spam Filters End User Interface & Support Introducing the Global Key Custodian

Business Model Perhaps the most significant benefit of an Permission Keys enabled system, is that it provides additional identifiable value to the end user – which can be used to generate an addition revenue stream to the service provider.

Business Model Monetization Revenue Sharing, (Subscription / Advertising sponsored) Increase Subscriptions Increased user loyalty Premium service There are a number of different models available to monetize the additional value that Permission Keys provide.

Business Model Urgency The Global Key Custodian Dynamic Web tags Corporate Spam Filters ISP Network Filters Desktop Spam Filters End User Interface & Support For example, if a desktop filter provider implements permission keys in their filter, and then at a later date the ISP implements permission keys in their Network filter, then while each instance would respect and use each others keys, the providers revenue share would go to the desktop provider – as they were the first to issue a key for that user. Under our revenue sharing model, once an address has been associated to a service provide then it can’t be changed.

What is lost costing you? Problems that result from lost messages –Unreliable communication –Misunderstandings –Damage to reputation / brand –Lost opportunities –Lost time –Exposure to spam What would it be worth to your users to solve these problems?

What have you lost today?

The advantage of CaseKeys over just white listing outbound recipients You can expire Permission Keys, and while you can blacklist an address you can’t issue the compromised user a new address. Permission Keys embed the key in the senders address, which propagates when the message is forwarded to a third user. Many users have multiple addresses feeding to the same inbox, so a reply may come from a different address. Permission Key can validate the legitimacy of “First Contact” and “News Letter” messages.

How does this reduce spam? Whenever a user has to check their Spam folder, then they are still being exposed to all of their Spam - only the folder name is different. CaseKeys may well be the difference between a system that users trust and one that they don't - the difference between exposure to all of the Spam, or no Spam.

Q. Does publishing a keyed address result in Spam being falsely white listed? Keys that are published on web pages are set to auto expire. In the event that a Key does fall in to the wrong hands and did result in a False Negative, then the user clicking “Is Spam” would invalidate the Key.

New Term Lost Message Rate (LMR) Is the percentage of legitimate messages that are mistaken for Spam. Traditionally the industry has used the statistical term “false positive” which does not truly reflect the proportion of legitimate messages that the filter is loosing.