bugtraq - Re: New whitepaper "The Phishing Guide"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 29 Sep 2004 13:11:18 +0300
From: "Philip Stoev" <philip@...ev.org>
To: <bugtraq@...urityfocus.com>
Subject: Re: New whitepaper "The Phishing Guide"

> Agreed but forcing phishers to generate key pairs, purchase
> certificates, and/or buy-off CA vendor personnel creates additional
> audit trails that could help in the tracking and prosecution of those
> individuals. Combine this with certificate revocation and you have at
> least a model that gives more verification, auditing, and remediation
> than currently exists in the pursuit of these criminals. It's at least a
> step in the right direction and shouldn't be avoided simply because it
> won't immediately stop all phishing attacks or protect all users.
>
> Watermarks do not stop all counterfeiting. Holograms do not stop all
> credit card fraud. It doesn't mean we shouldn't do what we can to help -
> even if its only a partial solution.

Phishing relies on the victim lacking the information or the intellectual
capability to distinguish genuine email or web page from a fake one. That is
why phishers attempt to use nearly-real URLs and shiny padlock icons so that
the user feels a false sense of security and correctness when he sends in
his social security number. If a phishing email is signed correctly, the
email client will display a padlock icon on its own plus assurances that the
email has been signed and valid and authenticated, etc. All this will
further the false sense of security that phishing relies on, unless the
email client is configured to explicitly display enough information on the
signature and enough warnings for the average user to be able to make an
informed decision.

Philip