Why I hate Challenge-Response


Now that I have been officially accepted into the “Security Bloggers Group” on LinkedIn (very cool!), I realize it’s time I shared some of my opinions on things rather than simply reporting on this or that malware outbreak (although some of you have indicated to me that the objective reporting of news in the messaging world is valuable to you, so don’t worry, I won’t go totally haywire on you). And today something happened that really lit my fuse, leading me to write the most opinionated title I have ever posted.

So here goes. I HATE CHALLENGE- RESPONSE. It’s unfriendly. It’s annoying. It’s NOT USER FRIENDLY. It may be ok for grandma (no offense to any of you red hot emailing grandma’s out there), but it does not belong in a corporate environment.

Some background: as most of you know, my actual job title is VP marketing at Commtouch, not blogger at large. Which means I spend most of my time doing (and managing) other marketing activities besides blogging, like PR strategy, meeting with journalists, webinars, events like RSA (fun fun fun!), etc. And today we sent out our email newsletter to our partners, customers and those other people who requested to receive it, otherwise known in the marketing & anti-spam world as having “opted in.” Being both a responsible marketer and a representative of an anti-spam company, it would never occur to us to send out — heaven forfend — unsolicited email, so we’re extra-super-careful to maintain our distribution list and only send to people we are already doing business with, or people who have otherwise opted in. And if someone eventually opts out (requests to unsubscribe) it’s such a production to ever re-subscribe him/her, that trust me, it can’t happen by mistake.

With that wordy background, I would like to relate an experience I had today when we the newsletter was sent out. Three people, all from the same company, were using challenge-response technology, which automatically returned an email, asking us to reply. A simple reply should have sent the signal to their C/R system that this is a legitimate email that they asked to receive. The emails we sent back to the C/R system bounced back to us, with an obnoxious message (slightly edited to protect the innocent): 550 Reject: Spam! this email has been discarded. The exclamation point was in there already, I didn’t add it. The nerve!

We put our heads together in the marketing department, since after all, these are people that requested to receive the newsletter. Maybe, we thought, the problem is that the newsletter was sent from an administrative address (“commtouch newsletter at…”) and the reply to the C/R filter was sent from someone’s personal mailbox, since after all, there is no such person as “Commtouch Newsletter.” So, since neither rain nor hail nor sleet nor obnoxious mail filtering software will prevent us from delivering the email, we decided to manually resend the newsletter to those three unfortunate souls, making sure that the “from” address was a real person, and not an administrative mailbox alias. Well, long story short, our response to the challenge was bounced back again, with the same obnoxious exclamation point. Sigh.

So I guess these guys don’t want to receive our newsletter after all. Or maybe they do… Just in case, since I’m a perfectionist, and 3 people missing out on quarterly email threat news is enough to keep me up at night, I bundled up all the responses from their email filter, and the bounce messages, and sent them in a big fat forwarded message to Elina, the main person in Commtouch who is in touch with them. She will try to reach out personally to see if there is something that can be done to allow us to send them the content that they requested to receive. Probably the whole issue will have to be consummated with a phone call, if not more than one call. Good luck!

BTW if you want to read our April newsletter, here’s a copy. And if you want to subscribe to the newsletter, please turn off your Challenge-Response before July when the next one comes out, since next time I may have to name names!

P.S. I’m not the only one at Commtouch who hates C/R – Yael ranted about it last year. At the time I thought she was overdoing it, but not anymore.

Go back