Study Finds IE7 + EV SSL Won't Stop Phishing

An anonymous reader writes "Stanford University and Microsoft Research have published a study that claims that the new Extended Validation SSL Certificates in IE7 are ineffective (PDF). The study, based on user testing, found that EV certificates don't improve users' ability to detect attacks, that the interface can be spoofed, and that training users actually decreases their ability to detect attacks. The study will be presented at Usable Security 2007 next month, which is a little late now that the new certificates are already being issued."

This really isn't an IE problem

[blowdart (31458)]

It's a user education problem, and it's probably too late. SSL has long been missold to end users as an indication of security and trust; it may well secure some communications but the trust aspect is bogus. The newer certificates attempt to add a more measurable trust metric, but without user education it will be useless. Warnings on screen simply get ignored. The study could have equally been done with Opera (which supports the new eval certificates. In addition they also used Firefox on the Mac to indicate a homograph attack.

Re:

[ePhil_One (634771)]

The newer certificates attempt to add a more measurable trust metric, but without user education it will be useless.

Did you even read the summary?

that training users actually decreases their ability to detect attacks

With user training they are even more worthless!

Re:This really isn't an IE problem

[blowdart (31458)]

I did, and wow, I even read the PDF. Aas I said it's probably too late now; the padlock is too engrained in user's minds as a way to indicate a site is trusthworthy and real.

If you read the paper the actual "worse when trained" only referred to sites where the phising toolbar notification was not displayed and not really as a function of EVA;

The participants who were asked to read the Internet Explorer help file were more likely to classify both real and fake sites as legitimate whenever the phishing warning did not appear.

and really, reading a help file is hardly training :)

Re:

[Fordiman (689627)]

I don't know why there's SO much push to make phishing more visible. What's more visible than the WRONG URL? Seriously. www.paypal.realsite.com doesn't look that much like www.paypal.com, does it? Phishing is one of the most 'out in the open' attacks there is; it's pretty damned obvious to anyone who glances up at their address bar that someone's trying to pull a fast one over on 'em.

As they say, a fool and his money are soon parted. If you get scammed by a phisher, I've got not pity for you. And mayb

Re:

[Fred_A (10934)]

Seriously. www.paypal.realsite.com doesn't look that much like www.paypal.com, does it?

Except that most users still havent understood the structure of hostnames, much less of URL/URIs. So a lot of them will fall for that kind of thing whatever you put in the address bar.

Re:

[ePhil_One (634771)]

So a lot of them will fall for that kind of thing whatever you put in the address bar.

And in some cases its possible to overwrite the address bar. In others its possible to corrupt DNS caches. There are subtle mispellings that are tricky to catch, and new domain names that look legit but aren't, like www.paypalsecurity.com (PayPal pays companies like Cyveillance to monitor for such bogus registrations). And whule it hasn't happened yet to my knowledge, the real coup will be gaining control of the DNS rec

Re:

[hobo sapiens (893427)]

If on one hand you try to educate people on how hostnames work, then yes, you cannot blame then when things go wrong.

Claims the users are responsible for what happens to them amount to blaming the victim.

No, I think the gist here is that people need to be at least somewhat responsible for their personal information. For example, if I get mugged when walking around in a bad neighborhood at night while wearing my finest leather coat, then I do share some responsibility. I should know better and take reas

Re:This really isn't an IE problem

[TheRaven64 (641858)]

Except that most users still havent understood the structure of hostnames

The real problem is that hostnames are written back to front. JANET in the UK used to write hostnames in the correct order, so this story would have been on org.slashdot.it. At each stage, you have progressive refinement. Writing hostnames the opposite way to filesystem paths (including those written after the hostname) makes no sense, and is just bad UI design. It's probably too late to switch now, but it would be much easier for a user to spot that com.phisher.com.paypal/long_path was not the same as com.paypal/long_path than it is to spot that paypal.com.phisher.com/long_path is not the same as paypal.com/long_path. Once you have spent a long time looking at URIs, it is very easy to regard .com (or .org, or co.uk) as the separator between the hostname and the path.

How do you initiate a Picture in Picture attack?

[Zeinfeld (263942)]

The paper discusses a picture in picture attack. I don't see how such an attack fits into any of the phishing attack vectors currently seen.

Let us imagine that we have an email message that takes us to a phishing site. But instead of taking us to a Web page we get a web page within the Web page. Is the user likely to notice? I suspect so.

The experiments don't test that scenario, instead they test the scenario where the user has a browser open with a PIP browser already there. This is a rather easier lay

Protect your information

[jmagar.com (67146)]

The best thing you can do is never give out your information. Protect it like you're a secret agent. Protect it against torturous interrogation. Protect it to point of taking that suicide pill hidden as the third button on your shirt.

Always ask yourself why they need it, and do you trust them to secure your information.

In Canada right now their are two separate [www.cbc.ca] credit card [www.cbc.ca] breaches under investigation. This isn't even a phishing thing, this is just plain old sloppy security.

I suspect that there are many other breaches that haven't been detected and or reported. So I strongly recommend that you refuse to give out personal information to these locations. Don't sign up for rewards cards, don't let them collect your address, and phone, and SSN, when you buy a t-shirt. They don't need it! And I don't trust them.

Re:

[19061969 (939279)]

I concur. I always give out false addresses whenever some website asks for mine.

On an unrelated note, has anyone noticed how slow Amazon are in delivering things?

Re:

[fossa (212602)]

A while back at the grocery store, I was offered the loyalty card. The cashier handed me a card and an application and said "fill this out at home and mail it in". Since I already had the card, I didn't bother mailing anything in, and the card is still working three months later. They can track my purchases, but only to an anonymous number. Of course, I pay with my credit card so they already have my name anyway ...

Re:

[enharmonix (988983)]

The best thing you can do is never give out your information. Protect it like you're a secret agent. Protect it against torturous interrogation. Protect it to point of taking that suicide pill hidden as the third button on your shirt.

Always ask yourself why they need it, and do you trust them to secure your information.

In Canada right now their are two separate [www.cbc.ca] credit card [www.cbc.ca] breaches under investigation. This isn't even a phishing thing, this is just plain old sloppy security.

I suspect that there are many other breaches that haven't been detected and or reported. So I strongly recommend that you refuse to give out personal information to these locations. Don't sign up for rewards cards, don't let them collect your address, and phone, and SSN, when you buy a t-shirt. They don't need it! And I don't trust them.

In that light, here are some handy tools for the justifiably paranoid:

1. TrueCrypt [truecrypt.org] - Excellent free encryption app for most platforms (even Windows)
2. 10 Minute Mail [10minutemail.com] - Free disposable email addresses
3. Private Phone [privatephone.com] - Free disposable phone numbers
4. MBNA Virtual Cards [washingtonpost.com]* - Virtual credit cards for online purchases that won't ruin your credit if stolen

Of course, if you're too paranoid to use option 4, just keep all your cash in your mattress and buy prepaid credit cards when you want to shop online.

Re:

[PitaBred (632671)]

Mine's "kookaburra". I promise. Where's that chocolate bar?

User Education

[kevin_conaway (585204)]

Any problem that relies solely on user education/training is doomed to failure because most users don't care or don't want to be trained. They just want it to work

No shit. Really?

[xxxJonBoyxxx (565205)]

EV certificates don't improve users' ability to detect attacks

No shit. Really?

These "EV certificates" are a joke. If you've been in the industry 5 years or more, you know that the pitch surrounding these certs is 100% identical to the pitch used to sell regular, commercial-CA-signed certs 5 years ago.

Users are right to be confused. When connecting to "consumer" applications from home they might see the IE green bar, but then they go to work and get used to seeing the IE red bar to connect to all their partners' "B2B" websites all day. (Lots, if not most companies seem to use self-signed certs or give out IP addresses to connect to rather than hostnames that match with a valid CA-signed cert for business-to-business web applications.)

Nothing is secure!

[140Mandak262Jamuna (970587)]

I recently got an account in Fidelity, one of the largest mutual funds with assets in billons of dollars. It has 6 to 10 digit numerical password. No special characters, no alphabets. Very simple authentication system. They should know that they will attract phishers and scammers like honey draws the bees. But still the top level decision makers still think like, "my customer is 65 years old and is not tech savvy. They will get confused, make it easy and simple for them". They are making it easy and simple for the phishers and scammers too. Schwab too has a simple username-password. Vanguard is a little better. It monitors the IP address of past logins and puts you through tougher login session first time you log in from a new location. Also it tries to login using two screens and displays a user selected personalization picture and caption to authenticate the server. My bank is horrible with just a four digit numerical password (for the quicken on line access atleast). Fidelity also uses Social Security number as a login id by default. Was not impressed by the login authentication methods of Alex Brown, National Discount Broker, Ameritrade and MFS in the past. Someday they are going to lose millions of dollars and then they will swing in the completely opposite direction and make use climb Mount Everest just to log in.

Re:

[caffeinemessiah (918089)]

Is your bank Sovereign Bank in the states, by any chance? Their online authentication system was Social Security / 4-digit pin (same as your ATM pin). I got so sick of it that I changed to Chase.

Re:

[Qzukk (229616)]

Someday they are going to lose millions of dollars

They? They? I think you'll find that the reason all of this is insecure is that the companies have worked hard and long to protect themselves against their own stupidity. Just try suing a bank for giving out a loan in your name to an impersonator and ruining your credit record. Hell, try suing the credit bureaus for telling the bank that some criminal was you, or for continuing to damage your reputation by leaving these things on your record for years af

Re:

[mpapet (761907)]

There is a standard not surprisingly formulated by VISA/MC/Europay callled EMV. It's not perfect, but it's very good. You'll notice not one peep out of financial institutions about switching to EMV while the rest of the world makes the transition albeit slowly.

One of the problems with it from the American Fascist perspective is it implements some security features that would change the way they collect data about idividual banking activities. Spying on your citizens on a national scale is tricky IT busin

One-sided study

[tsa (15680)]

It's a pity that, although other browsers are mentioned in the article, they were not used in the experiments so there is no way of comparing them to IE7, and thus we can not use this article to bash IE7. At least, not if you want to use facts.

*sigh*

[hobo sapiens (893427)]

Of course they're inneffective. Phishing is not an IE problem or a "security" problem. It's a trust problem. If someone was going door to door claiming to be a representative of a bank and asking for account numbers, most people would turn him away and call the cops. Why do we then trust a link in some unsolicited eMail with the same information? Geez.

What's unfortunate here is that since Microsoft, via IE7, made the attempt to protect users from phishing, now they have some degree of responsibility to fix what they never can. Don't claim that you will fix something if you cannot.

Re:

[Iphtashu Fitz (263795)]

Or you're teaching skills are worth absolute *shit*

Did you bother to RTFA? The teaching skills aren't the problem. The training the people went through was basically reading the on-line docs that come with IE7 since that's all the training the vast majority of users will ever have access to. It's the poorly written on-line help that is the problem. The on-line docs apparently say something to the effect of "this is what a phishing site will look like", so that's what the users expect to see when they vi

Re:

[steveo777 (183629)]

I think it's more like the headline should be, "Stupid People Still Stupid".

Just look up the definition of stupid. "Lacking ordinary quickness or keenness of mind". Meaning they either don't know how to learn the skills or simply don't care and ignore their teacher. You meet a lot of these people. Getting angry at the teacher might be justifiable, but as long as the information is presented, and the student wants to learn, there will likely be some skills picked up.

Re:

[Fordiman (689627)]

But the question is: 'What can we do as IE7 and EV's friends to help them quit their phishing habit?'