Hi Mark,
Re "authenticating the site".
I considered this option, and came up with a few ideas - basically
the site would post questions _AND_ answers to the user before
allowing him/her to enter their password.
Example:
"Hi Jones, your surname is 'InTheFastLane'.".
"Your favourite movie is Rambo".
"Etc".
This way, a phishing site couldn't possibly know the answers so they
would be incorrect.
However, and obviously, it's can be MITM'd easily.
I couldn't think of any other possibilities to ensure the site is the
correct site before the user enters there password other then that
which I proposed.
-- Michael
-----Original Message-----
From: Mark Burnett [mailto:mb@xato.net]
Sent: Tuesday, 30 November 2004 3:15 AM
To: webappsec@securityfocus.com
Subject: Re: Article - A solution to phishing
I have been watching this thread with great interest and although the
basic concept that Michael describes is interesting and might help
reduce phishing, as others have pointed out it is still vulnerable to
a number of other threats and heavily depends on a number of
assumptions that might not be realistic.
Nevertheless, the fundamental issue with phishing is not that an
attacker can obtain your credentials, but that an attacker can trick a
user into entering credentials in a fake web form. This is because it
is easy to create a fake web site that looks exactly like the original
and it is easy to direct the user to that site using deceptive links
in e-mails, browser vulnerabilities, DNS spoofing or poisoning, ARP
spoofing, stealth proxies, cross-site scripting, HOSTS file
modification, bookmark modification, trojans, social engineering, etc.
Protecting authentication credentials is also a problem, but the
solution to phishing is more one of authenticating the site rather
than authenticating the user. First solving the issue of
authenticating the site makes it easier to solve the problem of
authenticating the user.
Mark Burnett
------------------------------------------------------------------
Hacking the Code: ASP.NET Web Application Security http://www.hackingthecode.com
