Re: [Asrg] How would SPF or Sender ID stopped this attack

[Seth Breidbart <sethb at panix.com>]

Barry Shein <bzs at world.std.com> wrote:

> I'd imagine the best that can be done against phishing would be
> something done at the website like you enter a unique username, not
> an acct or anything very interesting to a stranger, and the BANK
> (e.g.)  should come back with a piece of information set up
> previously. So I type in bzs in preparation to actually logging in
> and the website should respond with "HADDOCK" and then I proceed, if
> not, I'm suspicious.

What stops the phisher from passing your input to the bank and its
output back to you (that is, the classis man-in-the-middle attack)?

Seth

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg