What, Why and How?

This article describes a simple and effective technique for protecting email addresses online - “PIN email”. A PIN email is an algorithm of numbers and characters that is included in the actual email address itself. This PIN is generated automatically, is unique per visitor, and critically, is on a timer. This has been developed for first time communication only, once verified, the sender is automatically added to the address book (white-list).

This approach is inexpensive, secure, and does not require a web visitor to do nothing more than clicking a mailto: link. This is important, as asking the visitor to do something “extra” simply does not work.

For the very first time the email address is under the control of its owner, rather than relying on an external entity.

1. Introduction

Most users of email receive unsolicited bulk email (so called “spam”). These can be a problem due to their bulk alone, time-wasted, the cost, the malware they carry, and potentially worse, they may expose people and children to content that is wholly unsuitable.

Numerous schemes for reducing the number of unsolicited e-mail messages presented to a user have been proposed. These include systems of filtering based on the content of a message, “Baysian” systems that try to determine whether or not a message is wanted based on a large range of parameters, whitelisting and blacklisting of e-mail addresses or IP addresses, and challenge/response systems, amongst many others.

All of these systems have some problems. Systems that filter and analyse messages are subject to generating “false positives”, where messages that are not, in fact, unsolicited are marked as such, and so go unseen by their intended recipient. Systems that rely upon manual whitelisting and blacklisting of arbitrary addresses require a lot of maintenance if their lists are to remain up-to-date, and challenge/response systems have the potential to create endless loops of messages if two such systems attempt to communicate with one another.

My goal was to find a way to protect users from unsolicited mail while overcoming, or at least ameliorating the problems of known systems. I wanted to concentrate on what I regard as the “pinch point” of this problem - harvesting email addresses.

2. The Permission Approach

The basis of the permission approach is to make the email address itself secure (rather than trying protect it after it has been compromised). I feel that current spam fighting techniques are like the old saying: “closing the stable door after the horse has bolted”. I see Permission as a preventative medicine.

This has been achieved by adding an authorisation code to the email in the following form:

<user> <PIN> @<domain>, e.g., mail.123456@permissiontosend.com

For greater security, a cryptic algorithm can be used for the PIN:

mail.cefc5ee5ccb2962aa2ca40a93c19584a9b6f97@permissiontosend.com

Although “uglier”, this can be hidden in a HTML mailto link:

Both the time of creation (POSIX time), and the expiry of authorisation code is encoded within the PIN. Since this algorithm can be applied to the authorisation code to determine whether it is an acceptable code, this avoids the need to provide a table, and allows authorisation codes to be generated without the need to involve the e-mail server. Once sent, the code is deciphered with a “seed value” on the receiving mail server.

The validity of the authorisation code may be limited to a period of several minutes, several hours or several days, as considered appropriate for a particular application. The authorisation code is only valid once, and, once the sender is added to address book, subsequent messages can be sent to the recipients conventional email address - that is, the email address without the authorisation code.

This method will provide an email address of short-term availability to all, which can be used to allow a sender to obtain long-term right to have their email messages delivered to a recipient.

From the point of view of the sender, they do not need to do anything extra, only click the mailto link in a conventional way.

3. How to Implement Permission

If you control the MX records, and the web server for your domain, then implementing permission is easy.

3.1 Download The Permission Files

Go to our website www.permissiontosend.com and click on “Get Started”. Register your detail and click “Paid Account” (The free account is for @permissiontosend address). Once you have verified your email address you can now download the files. Open the permissiontosend.php file in a text editor and add your sign-up email address and password in the space provided. Copy the files onto your webserver. Now insert the following code between your and tag of the page you want to use Permission on (The paths can be changed to suit your requirements):

	<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.6.4/jquery.min.js"> </script>
	       <script type="text/javascript" src="jquery.cookie.js"> </script>
	      <script type="text/javascript" src="permissiontosend.js"> </script>
	

Wherever you want an email address to appear on your website, place the following code:

				<div id="permissionemail_1"> </div>

			

3.2 Import Contacts

Once you have created your permission account, you can login and import your contacts in a .csv file. All imported contacts can send you an email without the authorisation PIN, therefore communicating carries on as normal.

3.3 Modify your MX Records

Login to your domain control panel, delete old records, and add the following:

 
				mx1.permission.mx. (Priority) 10
				mx2.permission.mx. (Priority) 20

Save your changes and wait for DNS propagation, this can take up to 24 hours.

Once updated your email will now be protected by permission, and giving you complete control.