A Foolproof Way To End Bank Account Phishing? 436
tcd004 writes "F-Secure's Mikko Hypponen proposes an elegant solution to the problem of bank account phishing in the latest Foreign Policy magazine. Hypponen thinks banks should have exclusive use of a new top-level domain: .bank. 'Registering new domains under such a top-level domain could then be restricted to bona fide financial organizations. And the price for the domain wouldn't be just a few dollars: it could be something like $50,000 — making it prohibitively expensive to most copycats. Banks would love this. They would move their existing online banks under a more secure domain in no time."
Cutting out the competition (Score:5, Interesting)
I'm reminded of the phrase... (Score:3, Interesting)
citibank.bank.customers.spammer.com (Score:3, Interesting)
citibank.com.customers.update.spammer.com
It wouldn't take any more effort to make:
citibank.bank.customers.update.spammer.com
Most people don't know much about URLs. And that's assuming the mark even reads the URL at all.
Re:dibs!!!!! (Score:3, Interesting)
I have dibs on data.bank.
Re:We'll see about that. (Score:5, Interesting)
In the rare event that a user does look at the url they see that first
Now, perhaps if bank sites didn't do immediate redirects when you visited them and kept the url in the address bar simple, then that may help. That way, if a user sees anything other than www.bank.com it should raise suspicion. But for the average user even a relatively simple url such as http://www.wamu.com/personal/default.asp [wamu.com] will cause their eyes to glaze over when all they typed in was www.wamu.com. So why should they look past the
it's not like they use their own domains now... (Score:5, Interesting)
To access account info for my wife's Fidelily Visa Card, I need to go to a site in the ibsnetaccess.com domain.
To access account info for my IRA, which I own through Citizens Funds, I need to go to a site in the websolcentral.com domain.
To access account info for my wife's 401K, which she owns through Fidelity Investments, I need to go to a site in the mysavingsatwork.com domain.
Honestly, it's like they're all trying to confuse people. Why should we expect anyone to recognize a phishing URL when the financial services companies won't host their own secure sites under their own domain names?
Re:Foolproof system (Score:5, Interesting)
You're funny and exactly right at the same time. Instead of stopping phishing by preventing stupid users from doing stupid things, lets instead make it harder for the phishers to blend in with the other bank traffic. I'll suggest (again) that every financial organization make a "catch a phisher" link on their page that provides a unique (so that phishers can't build a list of the trojans) account number / login information that the intelligent users can request from the bank. The users will provide this red flagged account information to the phisher, who upon logging in a few times with these flagged accounts causes the banks to silently freeze other transactions placed from the same source until they can determine who's account data has been compromised. You may also be able to keep the phisher connected enough to determine where they are located to assist with law enforcement. It's something like a distributed honey-pot attack against the phishers that will make their job very hard very fast and quickly eliminate phishing attacks against organizations that implement this scheme.
Re:Ummmmm... (Score:2, Interesting)
Well, you seem to be forgetting that IT WILL ONLY WORK FOR YOUR COMPUTER. Domain name registrars exist to allow you to purchase a name for ALL COMPUTERS to recognize.
The only way your method could be used successfully for phishing is if the attacker can modify /etc/hosts or %SYSTEMROOT%\System32\drivers\etc\hosts. But if they can do that, it's already game over, so to speak, for the victim, because that implies the attacker has to have other levels of access through which they can probably do more damage than a simple phishing attack could do...
Uncomprehending banks' e-mails (Score:3, Interesting)
Mind you, these are two otherwise fine enough banks that I do business with them. But if I didn't control my mail server - and know and trust the admins running my ISP's routers - I'd be taking on a level of risk that borders on idiotic.
Re:This idea is stupid (tld goldrush?) (Score:2, Interesting)
Re:We'll see about that. (Score:4, Interesting)
But for the average user even a relatively simple url such as http://www.wamu.com/personal/default.asp [wamu.com] will cause their eyes to glaze over when all they typed in was www.wamu.com.
Yup. And worse yet, that sort of thing allows the baddies to do something like www.blah blah/wamu.bank. So the ambiguousness of the period in the URL - used for both file and domain delimiters - will further obfuscate things.
The simple way to end phishing. (Score:5, Interesting)
When you get a phishing eMail, go to the URL. Enter some information. Not valid information unless you are a fool. Enter bogus crap. It's fun, and if everyone did it just once a month the phishers would be so crapflooded with false information that it'd be nigh impossible for them to separate the crap from the valid information. Phishing won't be worth the time anymore.
Same with the 419 scammers. I particularly enjoy messing with the 419 scammers for this very reason.
The only, and I mean only, reason these things proliferate is because its profitable. This type of scamming is VERY profitable. So, we should be focusing on how to make it a waste of time. That would attack the problem at its root: its profitability.
Obviously, this would take a large bite out of spam, another problem in itself. Sometimes you have to fight fire with fire.
It seems obvious to me, but clearly not so obvious to others. Instead of spending time making a decent browser that supports modern standards properly (though better than IE6), Microsoft spent (probably) millions of dollars developing this ridiculous phishing filter for IE7. That is NOT dealing with the problem at its root. Obviously, they don't get it. Am I alone here? Hello? Anyone?
Re:Not a problem (Score:4, Interesting)
Re:Suckers usually use IE or AOL, not Firefox... (Score:5, Interesting)
Re:The simple way to end phishing. (Score:4, Interesting)
When you mess with 419 scammers, you get the added bonus of being creative. You get to play whatever role you want, you get to mess with someone's head, and you are on the moral higher ground because they are, after all, trying to steal your money!
No way would I let a program do that for me!
I guess the only concern I can think of with going to phishing sites is that they then have your IP. So don't do that if you don't have a firewall. Then again, rip your network cable out of the wall if you don't have a firewall.
Re:How will this stop XSS (Score:5, Interesting)
In browers that supported the
The results wouldn't make sites on that domain entirely secure, but with just a LITTLE community backing from mozilla, microsoft, and the others, it would help GREATLY, its a step in the right direction at the very least.
Re:This is already a solvable problem. (Score:3, Interesting)
In addition, the device needs buttons to signal the authorization and to enter a pin. It doesn't necessarily need a full keypad. Four buttons might be enough. You can't trust people's computer's not to capture their pins if they type it in at their keyboards. If there's no authorization button then a trojan can make unrestricted transactions whenever the device is plugged in.
Personal computers will probably never be very secure because they are made to do too many things. A small purpose built security device could have simple enough software that it may be able to achieve strong security.
A small keychain size device with maybe a two line display and four buttons would be reasonably convenient and would probably only cost about $10 in large quantity. They would probably need to be shareable between banks though because you're probably not going to want to carry very many if they're not thin like credit cards. Although there's a new credit card coming out with a display. A flexible display I guess. I see now reason they couldn't put some thin buttons on them.
Re:We'll see about that. (Score:5, Interesting)
How about browsers like FF, IE, Opera, et al highlighting the domain in bold and in a different color in the address bar?
http//www.wamu.com/personal/default.asp
That calls more attention to the part of the URL which deserves the most attention, no? And how about upping the point size on the address bar too? I look at the top of my browser and I see a sea of similar black type.
Re:The simple way to end phishing. (Score:5, Interesting)
As a system admin at my company, we got a call from a user who said she was a victim of a phishing scam, and wanted to see if we could get a copy of the phising e-mail she was sent so she could forward it to her bank and the police, but since she had already deleted it.
We managed to recover the phising e-mail. It was a standard phishing e-mail, however, it was not sent to her form the phisher him/herself, but from a friend of hers!
The subject had the FWD: tag at the begining, and the first line of the e-mail said, "Hey look! A banking scam! Why don't we all put in bogus information and screw them up! hehe!", but this user clicked on the link and entered her *real* information, as she thought it really was from her bank after she read the "security warning" below her friends comment.
Don't under estimate the power of the stupid.
Re:We'll see about that. (Score:5, Interesting)
It provides a coloured bar (yellow/green) for HTTPS connections in which a user-provided identifier is displayed. So you type in the secure site's URL the first time (https://my.bank.com/), then enter an identifier in the petname bar ("Online banking (Twylite)"). Every time you connect to the site in future the extension will pick up an exact match on the domain name and change the bar to green. Other untrusted SSL sites get yellow. Non-SSL sites are white.
Re:How will this stop XSS (Score:2, Interesting)
-
- When visiting a
If you combine these two steps with an information push to end users, we could finally get somewhere. Let Banks send out newsletters about security, let TV shows warn people, get the banks to buy some page sized advertisements together in all the papers to tell the story how they are really secure. If all major browsers work together on this as well as the banks and the media this could work out.
Having a seperate
A Small Price to Pay? (Score:2, Interesting)
And even after the bank has jumped through the hoops and paid the exorbitant registration fees, as others have pointed out, consumers who fall for phishing schemes tend to be less sophisticated Internet users and are probably not paying attention to the link they're clicking on anyways.