Hashcash, is this really used?

Question

I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?

Answer 1

Yes its used, in a number of mail delivery/filtering sytems. The most recognized and widely used of which is spamassassin, used by some major ISPs and mail services. See http://hashcash.org/mail/

You might also want to read the hashcash FAQ: http://hashcash.org/faq/

It is also used in various other protocols and applications including for combating blog spam. And you may have heard of bitcoin - hashcash is the underlying mechanism used as the work function in bitcoin.

Answer 2

No. It is not used. It forces the sender to waste a bunch of CPU cycles, and prove that he has done so, in hopes of cutting down spam. Unfortunately, this doesn't work. There are two severe problems with this approach:

• It won't stop spam. Spammers often use a botnet of compromised PCs. They can just have those compromised PCs perform the wasteful computation and prove that they have done so, and then their spam will get through the hashcash filter.

• Hashcash interacts poorly with mailing lists. If I want to send an email to a mailing list with 1000 people, I'll have to waste a bunch of CPU cycles 1000 times (once for each recipient). That means that legitimate senders are prevented from sending to a mailing list, or have to waste huge amounts of CPU to do so. That's not really acceptable.

So, overall, hashcash is dead. No one uses it, because it wouldn't work at deterring spam. It was a cute idea that turns out not to solve the actual real-world problem. Oh well, so it goes!

Edit 4/28: For more details about why hashcash is not a solution to spam, read the following research paper:

• "Proof-of-Work" Proves Not to Work. Ben Laurie, Richard Clayton. WEAS 2004.

Wikipedia also has a short discussion of some of these issues.

Answer 3

I haven't seen this technology implemented (or openly discussed) in most major commercial email filters.

So hashcash is not a new idea. It dates back to at least 2003. I've heard this concept discussed a bit earlier than 2003 too.

It's based on a simple premise and forces the sender to expend CPU cycles to compute hash tags for each message. I believe this method assumed that each spam message may have been less valuable than the cost of computing the hashtag. If the value of each spam message was greater than the CPU cycle cost, then such a method would not deter a spammer.

With this type of technology, the effectiveness also depends on the recipient's implementation email implementation. If the recipient's mail server didn't enforce or check the results of the hash computation, then any sender can spoof results or simply create a fake value to add to each outgoing message.

The challenge to block spam is to tie together controls at both the sender and recipient. When there's lack of synergy, the effectiveness is greatly reduced or completely eliminated. Imagine if all senders computed hashcash but recipients never checked the has value. That would create an ineffective system where the sender is wasting CPU cycles computing something of no value. In addition, there's additional data to be transmitted per message which increases bandwidth and storage requirements compared to not computing and adding hashcash values in the header.

Most current anti-spam products use a number of different methods to identity spam with pretty high accuracy.