A commentator on my recent entry brought up D. J. Bernstein's Internet Mail 2000 as a possible cure for phish spam. The defining characteristic of IM2000 is that the sender, not the recipient, stores the message; the recipient merely retrieves it when they want to read it. Let's set aside all of the practical issues with sender storage schemes and ask a simple question: will they actually work to stop phish spam? Unfortunately, the answer is no. If anything, they might make it easier.

The belief that such schemes can do anything about phish spam (and spam in general) assume that spammers will have problems finding capable hosts to hold their spam or keeping the hosts available. In the case of phish spammers, this is demonstrably false; much phish spam today is sent from compromised servers (ones that already send legitimate email) and we know that they often go unfixed for significant periods of time. Nor will the spamming be any more noticable; an ISP or company that fails to notice the volume of outgoing SMTP messages now is not likely to notice the same network volume from notifications and message retrievals.

(Since the compromised servers are legitimate email senders to start with, their 'mail access' is not going to be blocked by firewalls and the like any more than firewalls are blocking their outbound SMTP traffic today.)

Nor will the load of people retrieving their phish spam crush the server; these days it is almost trivially easy to make highly scalable software that serves static or mostly static content, especially when the content is small enough to fit into RAM. (The web server world provides you with lots of examples to steal from.)