Re: Article - A solution to phishing

I have been watching this thread with great interest and although the basic 
concept that Michael describes is interesting and might help reduce phishing, 
as others have pointed out it is still vulnerable to a number of other threats 
and heavily depends on a number of assumptions that might not be realistic.

Nevertheless, the fundamental issue with phishing is not that an attacker can 
obtain your credentials, but that an attacker can trick a user into entering 
credentials in a fake web form. This is because it is easy to create a fake web 
site that looks exactly like the original and it is easy to direct the user to 
that site using deceptive links in e-mails, browser vulnerabilities, DNS 
spoofing or poisoning, ARP spoofing, stealth proxies, cross-site scripting, 
HOSTS file modification, bookmark modification, trojans, social engineering, 
etc. 

Protecting authentication credentials is also a problem, but the solution to 
phishing is more one of authenticating the site rather than authenticating the 
user. First solving the issue of authenticating the site makes it easier to 
solve the problem of authenticating the user.


Mark Burnett


------------------------------------------------------------------
Hacking the Code: ASP.NET Web Application Security
http://www.hackingthecode.com