WebApp Sec mailing list archives
RE: Article - A solution to phishing
From: "WebAppSecurity [Technicalinfo.net]" <webappsec () technicalinfo net>
Date: Tue, 30 Nov 2004 10:23:25 -0000
Image-based authentication is certainly an important part of helping with customer confidence in the web-application they are accessing. By allowing the user to view a known/selected/chosen/uploaded photo before entering their second round of authentication information (e.g. Round One = Surname and Online Reference number -- Round Two = Pin code and random parts of their shared password) they can help be assured that they are at least connected to their real web-application [yes, I know that any transparent proxying will defeat this - but MITM is difficult to prevent from the client end]. I have been recommending this process to my financial clients for several years now... And have seen some good implementations of it in Europe. For some more information on this see http://www.technicalinfo.net/papers/Phishing6.html#3.3.3.CustomWebApplicatio nSecurity Cheers, Gunter
-----Original Message----- From: Dave Jevans [mailto:djevans () teros com] Sent: 29 November 2004 22:55 To: Michael Silk; webappsec () securityfocus com; mb () xato net Subject: RE: Article - A solution to phishing Imaged based mutual auth a la passmark can also authenticate the site to the user. -----Original Message----- From: Michael Silk [mailto:michaelsilk () gmail com] Sent: Monday, November 29, 2004 2:07 PM To: webappsec () securityfocus com; mb () xato net Subject: RE: Article - A solution to phishing Hi Mark, Re "authenticating the site". I considered this option, and came up with a few ideas - basically the site would post questions _AND_ answers to the user before allowing him/her to enter their password. Example: "Hi Jones, your surname is 'InTheFastLane'.". "Your favourite movie is Rambo". "Etc". This way, a phishing site couldn't possibly know the answers so they would be incorrect. However, and obviously, it's can be MITM'd easily. I couldn't think of any other possibilities to ensure the site is the correct site before the user enters there password other then that which I proposed. -- Michael -----Original Message----- From: Mark Burnett [mailto:mb () xato net] Sent: Tuesday, 30 November 2004 3:15 AM To: webappsec () securityfocus com Subject: Re: Article - A solution to phishing I have been watching this thread with great interest and although the basic concept that Michael describes is interesting and might help reduce phishing, as others have pointed out it is still vulnerable to a number of other threats and heavily depends on a number of assumptions that might not be realistic. Nevertheless, the fundamental issue with phishing is not that an attacker can obtain your credentials, but that an attacker can trick a user into entering credentials in a fake web form. This is because it is easy to create a fake web site that looks exactly like the original and it is easy to direct the user to that site using deceptive links in e-mails, browser vulnerabilities, DNS spoofing or poisoning, ARP spoofing, stealth proxies, cross-site scripting, HOSTS file modification, bookmark modification, trojans, social engineering, etc. Protecting authentication credentials is also a problem, but the solution to phishing is more one of authenticating the site rather than authenticating the user. First solving the issue of authenticating the site makes it easier to solve the problem of authenticating the user. Mark Burnett ------------------------------------------------------------------ Hacking the Code: ASP.NET Web Application Security http://www.hackingthecode.com
Current thread:
- RE: Article - A solution to phishing, (continued)
- RE: Article - A solution to phishing focus (Nov 29)
- Re: Article - A solution to phishing Tran Viet Phuong (Nov 29)
- Re: Article - A solution to phishing Saqib . N . Ali (Nov 29)
- Re: Article - A solution to phishing Mark Burnett (Nov 29)
- RE: Article - A solution to phishing WebAppSecurity [Technicalinfo.net] (Nov 29)
- Re: Article - A solution to phishing Michael Silk (Nov 29)
- RE: Article - A solution to phishing WebAppSecurity [Technicalinfo.net] (Nov 29)
- RE: Article - A solution to phishing Michael Silk (Nov 29)
- RE: Article - A solution to phishing Dave Jevans (Nov 29)
- RE: Article - A solution to phishing Dave Jevans (Nov 30)
- RE: Article - A solution to phishing WebAppSecurity [Technicalinfo.net] (Nov 30)
- RE: Article - A solution to phishing Michael Silk (Nov 30)
- Re: Article - A solution to phishing Jeremiah Grossman (Dec 01)
- Re: Article - A solution to phishing Adam Shostack (Dec 02)
- Re: Article - A solution to phishing [Passmark] Jeremiah Grossman (Dec 02)
- Re: Article - A solution to phishing Robert Hajime Lanning (Dec 02)
- Re: Article - A solution to phishing Jeremiah Grossman (Dec 01)
- Re: Article - A solution to phishing Jimi Thompson (Dec 01)