Re: [Asrg] How would SPF or Sender ID stopped this attack

[Seth Breidbart <sethb at panix.com>]

Barry Shein <bzs at world.std.com> wrote:
> On July 30, 2004 at 19:40 sethb at panix.com (Seth Breidbart) wrote:
> > Barry Shein <bzs at world.std.com> wrote:
> > 
> > > I'd imagine the best that can be done against phishing would be
> > > something done at the website like you enter a unique username, not
> > > an acct or anything very interesting to a stranger, and the BANK
> > > (e.g.)  should come back with a piece of information set up
> > > previously. So I type in bzs in preparation to actually logging in
> > > and the website should respond with "HADDOCK" and then I proceed, if
> > > not, I'm suspicious.
> > 
> > What stops the phisher from passing your input to the bank and its
> > output back to you (that is, the classis man-in-the-middle attack)?
>
> A fine question, back to the drawing board. The bank only responding
> to that query via a secure connections could help which should be the
> case anyhow (yes I'm thinking out loud, but isn't that one of the
> design goals of secure web communications?)

Still not good enough: nothing stops the phisher from opening an https
connection to the bank.  The phisher can even get his own certificate
as "USBank-Security.com" so the sucker sees a "locked" connection.

If the victim is going to be a sucker, technological prevention just
doesn't work.

> But I suspect that sort of approach might yield better results than
> trying to clean up the email part of the con, for phishing
> specifically.

Combining all of them will help a little more than any one of them.

We need social solutions: "a few good hangings".

Seth

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg