Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?

share|improve this question

3 Answers 3

No. It is not used. It forces the sender to waste a bunch of CPU cycles, and prove that he has done so, in hopes of cutting down spam. Unfortunately, this doesn't work. There are two severe problems with this approach:

  • It won't stop spam. Spammers often use a botnet of compromised PCs. They can just have those compromised PCs perform the wasteful computation and prove that they have done so, and then their spam will get through the hashcash filter.

  • Hashcash interacts poorly with mailing lists. If I want to send an email to a mailing list with 1000 people, I'll have to waste a bunch of CPU cycles 1000 times (once for each recipient). That means that legitimate senders are prevented from sending to a mailing list, or have to waste huge amounts of CPU to do so. That's not really acceptable.

So, overall, hashcash is dead. No one uses it, because it wouldn't work at deterring spam. It was a cute idea that turns out not to solve the actual real-world problem. Oh well, so it goes!

Edit 4/28: For more details about why hashcash is not a solution to spam, read the following research paper:

Wikipedia also has a short discussion of some of these issues.

share|improve this answer
    
Cool thanks. Is it really not used? I can see why it is not great but are email / delivery systems really not using that? Botnet are expensive obviously so it could be a mitigation for cheap spammers. –  Dpp Apr 28 '12 at 16:41
    
@Dpp, it is really not used. Really. My understanding is that the fraction of all email in the world that has hashcash attached is 0%, to an extremely good approximation. Turns out that other mechanisms are a better way to stop spam. IF you'd like more details, see my edit for further elaboration. –  D.W. Apr 28 '12 at 20:55
1  
I've -1'ed this, because it is used in quite a few situations. WP-Hashcash is quite widely utilised, and there are similar add-ons for popular forum software. See Adam Back's answer for more details. –  Polynomial Apr 30 '12 at 12:16

Yes its used, in a number of mail delivery/filtering sytems. The most recognized and widely used of which is spamassassin, used by some major ISPs and mail services. See http://hashcash.org/mail/

You might also want to read the hashcash FAQ: http://hashcash.org/faq/

It is also used in various other protocols and applications including for combating blog spam. And you may have heard of bitcoin - hashcash is the underlying mechanism used as the work function in bitcoin.

share|improve this answer
2  
Welcome to StackExchange, Adam! You say it is used, but can you give examples where? The site you link to gives examples of software that support hashcash, which is different from saying that major email senders are using it (inserting hashcash into their emails), and different from saying that a non-trivial fraction of email in the world has hashcash attached. –  D.W. Apr 28 '12 at 20:57
4  
P.S. For those who don't know, Adam Back was the inventor of hashcash. Very cool to have him here on this site! –  D.W. Apr 28 '12 at 21:01
    
I'll also point out that WP-Hashcash, a Wordpress extension that uses hashcash to deter spam, looks like it has about 200K downloads at the moment. –  D.W. Apr 28 '12 at 21:02
    
So it seems to be used at least in some blogs I guess. Tough to tell if it's actually used by major email senders. –  Dpp Apr 29 '12 at 19:04

I haven't seen this technology implemented (or openly discussed) in most major commercial email filters.

So hashcash is not a new idea. It dates back to at least 2003. I've heard this concept discussed a bit earlier than 2003 too.

It's based on a simple premise and forces the sender to expend CPU cycles to compute hash tags for each message. I believe this method assumed that each spam message may have been less valuable than the cost of computing the hashtag. If the value of each spam message was greater than the CPU cycle cost, then such a method would not deter a spammer.

With this type of technology, the effectiveness also depends on the recipient's implementation email implementation. If the recipient's mail server didn't enforce or check the results of the hash computation, then any sender can spoof results or simply create a fake value to add to each outgoing message.

The challenge to block spam is to tie together controls at both the sender and recipient. When there's lack of synergy, the effectiveness is greatly reduced or completely eliminated. Imagine if all senders computed hashcash but recipients never checked the has value. That would create an ineffective system where the sender is wasting CPU cycles computing something of no value. In addition, there's additional data to be transmitted per message which increases bandwidth and storage requirements compared to not computing and adding hashcash values in the header.

Most current anti-spam products use a number of different methods to identity spam with pretty high accuracy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.