Bugtraq mailing list archives
Re: New whitepaper "The Phishing Guide"
From: "Philip Stoev" <philip () stoev org>
Date: Wed, 29 Sep 2004 13:11:18 +0300
Agreed but forcing phishers to generate key pairs, purchase certificates, and/or buy-off CA vendor personnel creates additional audit trails that could help in the tracking and prosecution of those individuals. Combine this with certificate revocation and you have at least a model that gives more verification, auditing, and remediation than currently exists in the pursuit of these criminals. It's at least a step in the right direction and shouldn't be avoided simply because it won't immediately stop all phishing attacks or protect all users. Watermarks do not stop all counterfeiting. Holograms do not stop all credit card fraud. It doesn't mean we shouldn't do what we can to help - even if its only a partial solution.
Phishing relies on the victim lacking the information or the intellectual capability to distinguish genuine email or web page from a fake one. That is why phishers attempt to use nearly-real URLs and shiny padlock icons so that the user feels a false sense of security and correctness when he sends in his social security number. If a phishing email is signed correctly, the email client will display a padlock icon on its own plus assurances that the email has been signed and valid and authenticated, etc. All this will further the false sense of security that phishing relies on, unless the email client is configured to explicitly display enough information on the signature and enough warnings for the average user to be able to make an informed decision. Philip
Current thread:
- New whitepaper "The Phishing Guide" Gunter Ollmann (NGS) (Sep 22)
- Re: New whitepaper "The Phishing Guide" Aleksandar Milivojevic (Sep 23)
- Re: New whitepaper "The Phishing Guide" Seth Arnold (Sep 24)
- Re: New whitepaper "The Phishing Guide" Aleksandar Milivojevic (Sep 27)
- Re: New whitepaper "The Phishing Guide" Greg A. Woods (Sep 27)
- Re: New whitepaper "The Phishing Guide" Crispin Cowan (Sep 28)
- Re: New whitepaper "The Phishing Guide" Seth Arnold (Sep 24)
- Re: New whitepaper "The Phishing Guide" Daniel Veditz (Sep 26)
- Re: New whitepaper "The Phishing Guide" Chip Andrews (Sep 27)
- Re: New whitepaper "The Phishing Guide" Philip Stoev (Sep 29)
- Re: New whitepaper "The Phishing Guide" Juraj Bednar (Sep 28)
- Re: New whitepaper "The Phishing Guide" Brian Dessent (Sep 28)
- Re: New whitepaper "The Phishing Guide" Aleksandar Milivojevic (Sep 23)
- Re[2]: New whitepaper "The Phishing Guide" Karsten Heidrich (Sep 28)
- <Possible follow-ups>
- RE: New whitepaper "The Phishing Guide" Dehner, Benjamin T. (Sep 25)