|
Why Phishers Don't Fear SSL Toolbars |
|
|
|
Source: Email Battles - Posted by Eric Lubow
|
Do anti-phishing toolbars in web browsers stop phishing attacks? No. Can they reduce them, even for savvy users? Yes. Are they all equally effective? No. MIT researchers found that users are highly likely to ignore anti-phishing toolbars... especially those designed to verify SSL certificates. The researchers installed browser toolbars without training the subjects in their proper use. Then subjects were asked to do various tasks requiring a username and password, like adding to a Wish List. The subjects incorrectly divulged usernames and passwords to the phishing sites 52% of the time. After users were dragged through a tutorial, successful Neutral Info toolbar spoofs dropped to 28% while spoofs of those using System Decision toolbars plummeted to 15%. SSL-verification users were fooled 35% of the time.
We tried to make every toolbar accurate enough to distinguish phishing sites from legitimate sites. The System-Decision toolbar displayed a red or yellow light at the phishing sites but a green light at the good sites. The Neutral-Information toolbar showed all phishing sites as either a "new site" or hosted in a non-US country (or both), but all good sites as hosted in the US and in existence for several years. But it turned out that 9 of the 18 online stores that we chose for this study had login pages that were not protected by SSL, so the SSL-Verification toolbar produced warnings even for legitimate sites. Thus, the SSL-Verification toolbar failed to adequately distinguish fake sites from good ones.
Read this full article at Email Battles
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
