More from SOUPS

Excellent paper on phishing from Dhamija and Tygar of UCB, The Battle Against Phishing: Dynamic Security Skins. Doug Tygar, you may know, was co-author of the security+HCI paper Why Johnny Can't Encrypt. They describe the problem of phishing, make a systematic analysis of the technical challenges, survey current phishing countermeasures, and describe countermeasures of their own.

Their proposed countermeasure attempts to address the lack of a trusted interaction path between users and servers for either data entry or security notices (such as the classic padlock). This is because of what they call the general purpose graphics property: on existing computer systems, anything a legitimate website can arrange to appear on the user's screen, a phishing site can put on the screen — or at least similar-looking enough that users won't notice.

A quick summary of how their system works:

1. They use Tom Wu's Secure Remote Password protocol to allow low-entropy (bad) user-selected passwords as mutual authenticator for user and server. This is a verifier-based protocol where passwords aren't given to the server.
2. Users choose an image to be used as a backdrop to a password entry window. Only the user's machine has this, so attackers can't guess it.
3. The a visual hash of the verifier is used by the server to decorate data entry pages (i.e., as background), so that the website has a user-specific look.

...of course this stuff is still vulnerable to man-in-the-middle, but that's not the phishing problem.

And as an counter to sophisticates who despair that users can't be trained to distinguish between indicators (e.g., the padlock) in the browser chrome from indicators in the page, they show a Citicorp page where a teeny padlock is on the page next to the password entry box to show that although the page isn't protected, the form will be sent via an SSL-protected HTTP Post!