Re: [Asrg] How would SPF or Sender ID stopped this attack

[Barry Shein <bzs at world.std.com>]

On July 30, 2004 at 19:40 sethb at panix.com (Seth Breidbart) wrote:
 > Barry Shein <bzs at world.std.com> wrote:
 > 
 > > I'd imagine the best that can be done against phishing would be
 > > something done at the website like you enter a unique username, not
 > > an acct or anything very interesting to a stranger, and the BANK
 > > (e.g.)  should come back with a piece of information set up
 > > previously. So I type in bzs in preparation to actually logging in
 > > and the website should respond with "HADDOCK" and then I proceed, if
 > > not, I'm suspicious.
 > 
 > What stops the phisher from passing your input to the bank and its
 > output back to you (that is, the classis man-in-the-middle attack)?

A fine question, back to the drawing board. The bank only responding
to that query via a secure connections could help which should be the
case anyhow (yes I'm thinking out loud, but isn't that one of the
design goals of secure web communications?)

But I suspect that sort of approach might yield better results than
trying to clean up the email part of the con, for phishing
specifically.

All of these problems and quite a few others (e.g., music piracy) come
down to a similar core problem: We've given people inexpensive, easy
to use, near-perfect printing presses and now we're plagued with
counterfeiting. What a surprise!

-- 
        -Barry Shein

Software Tool & Die    | bzs at TheWorld.com           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg