Real World Computing
A spam-free mailbox!
A cursory glance at the ZoEmail (www.zoemail.com) service suggests it has a lot working against it - it's web-based with the usual limited interface, it stamps a self-advertising signature at the end of every email you send and expects you, the user, to pay an annual fee for the privilege. However, there's still more than meets the eye to this innovative email solution, not least of which is the double-whammy Holy Grail promise of no spam and no false positives either. Ever. Of course, I just had to try it out and see firstly if it worked, and in the event that it did, exactly how it worked.
Based upon technology developed at the AT&T research labs that goes under banner of 'Total Inbox Privacy', ZoEmail approaches the spam problem in a unique way. I hope you're paying attention, because 'here comes the science bit'. Whenever you send an email, the system allocates an automatically generated random key that becomes an integral part of your email address. The use of alphanumeric keys isn't exactly rocket science, but where ZoEmail gets clever is that this key becomes part of your email address for that particular recipient only. The recipient then saves this as your email address and uses it like any other, secure in the knowledge that the key is authorised by the system to let their email get through to you.
A key management system enables you to revoke the key at any time, literally in fact. You can schedule a key to expire after any given date, or after a particular number of messages are received. Every person you send an email to gets a different, unique key and you can personalise these keys if you don't like the system-generated ones, although anything that interferes with the randomness of key selection has the potential to weaken the strength of the barrier between you and the spammer. For example, davey@zoemail.net becomes davey.zippy57@zoemail.net, or davey.32raccoon@zoemail.net for another user and so on.
Of course, this authenticated-senders-only approach to email does present some obvious problems, such as what email address can you put on your business cards? ZoEmail suggests the creation of custom keys for this purpose, something easy for you to remember but equally unlikely to be guessed by a spammer. So davey.compconsult@zoemail.net could be saved as my 'business card' key, to be distributed to multiple recipients by leaving the 'email address' of the recipient blank, knowing that ZoEmail will automatically create unique keys for each individual that contacts you using that address. This sort of solves the problem of business distribution, but still leaves me a little cold as regards my branding and public image - sure I want a spam-free mailbox, but I also want an email address that's easily remembered by those who want to contact me, and which reflects well on my business prowess. I can't help feeling that the use of Mickey Mouse email addresses is a step backwards in this respect, as it harks back to the days when nobody owned their own domain and we all had utterly unintelligible addresses forced upon us by our ISP. But it could be that ultimately we'll have to look at such drastic measures as ZoEmail and its authentication keys in order to be able to continue using email efficiently - spammers have a lot to answer for.
Whereas several other 'challenge-response' systems can also stop spam dead, they all introduce additional steps into the email process that can actually confuse genuine senders to the point of abandoning the attempt. Indeed, given that my advice to clients is that they should never respond to unsolicited mail asking them to click through an embedded link - for fear of virus/trojan or other malicious activity - then I wouldn't expect any challenge-response system to work for them. Such systems also don't handle mailing lists or automated e-commerce transaction messages efficiently (or in fact at all). The ZoEmail system on the other hand works well with both, and brings the added benefit of introducing an audit trail for each specific keyed address. So if some online business sells your email details on, and you get spammed as a result, you'll know exactly who the culprit was by way of the unique key involved.
