Followup on "Solution to Phishing"
Just a quick note..
I left a few disadvantages out :)
a) Username/email disclosure.
It would be appropriate, from a user's point of view, for them to get a message confirming whether the email address or username that they typed in was correct or not. If they were to receive no such message they may sit back and wait for the email to come and never receive it hence getting quite annoyed :)
b) Security of the system is "pushed off" onto the security of your email box.
Because your password only ever arrives by email (not phone, or physical letter, as some banks do) you (the user) really need to make sure you have secure access to your email at the point you request a login. If you don't, someone else will get access because no other information is required other then the email click.
A solution to this becomes obvious - ask additional questions once clicking the email. This could work well, but, of course, isn't perfect as suddenly a Phisher could gain this information by providing the link, with a fake password, retrieving the additional information from you and then saying "Oops, password timed out".
We can note, however, that in this situation the phisher would be required to also have access to your email account; which the typical Phisher doesn't have (but a Phisher from your office might ...).
Hence, the ultimate implementation of this solution is to encrypt the email public/private style and you initiate the decryption via a program external to your email program (i.e. smart card, usb device etc). This would prevent email interception.
I left a few disadvantages out :)
a) Username/email disclosure.
It would be appropriate, from a user's point of view, for them to get a message confirming whether the email address or username that they typed in was correct or not. If they were to receive no such message they may sit back and wait for the email to come and never receive it hence getting quite annoyed :)
b) Security of the system is "pushed off" onto the security of your email box.
Because your password only ever arrives by email (not phone, or physical letter, as some banks do) you (the user) really need to make sure you have secure access to your email at the point you request a login. If you don't, someone else will get access because no other information is required other then the email click.
A solution to this becomes obvious - ask additional questions once clicking the email. This could work well, but, of course, isn't perfect as suddenly a Phisher could gain this information by providing the link, with a fake password, retrieving the additional information from you and then saying "Oops, password timed out".
We can note, however, that in this situation the phisher would be required to also have access to your email account; which the typical Phisher doesn't have (but a Phisher from your office might ...).
Hence, the ultimate implementation of this solution is to encrypt the email public/private style and you initiate the decryption via a program external to your email program (i.e. smart card, usb device etc). This would prevent email interception.
PS: Your email provider obviously can't implement this solution :)
posted by michael silk at 3:10 PM
<< Home