PayPal Plans To Ban Unsafe Browsers 367
Alternative Details brings news that PayPal is developing a plan to stop users from accessing its financial services if they aren't using browsers with anti-phishing protection. PayPal is recommending the use of blacklists, anti-fraud warning pages, and EV SSL certificates. Browsers without anti-phishing features will be considered "unsafe." It seems likely Safari will be included in this category given PayPal's warning about the Apple browser last month.
"'At PayPal, we are in the process of reimplementing controls which will first warn our customers when logging in to PayPal of those browsers that we consider unsafe. Later, we plan on blocking customers from accessing the site from the most unsafe--usually the oldest--browsers,' he declared. Barrett only mentioned old, out-of-support versions of Microsoft's Internet Explorer among this group of 'unsafe browsers,' but it's clear his warning extends to Apple's Safari browser, which offers no anti-phishing protection and does not support the use of EV SSL certificates."
What If?... (Score:5, Insightful)
Sounds about right. Root Cause Ignored. (Score:2, Insightful)
I don't like to blame the victim but who clicks a link in an email? Really. Any site that makes it hard for me to get things done from their front page does not deserve my business, so I'll never follow the phish. The reason people still fall for this stuff is because copyright warriors and other IPtards make browsers and sites more complex than they need to be.
If Iceweasel and Konqueror are not on their "safe" list, I won't be able to use them even if I want to. Either the EWeek author or PayPal is
Re: (Score:2)
More people than you think. Many of them aren't sophisticated enough to look at the URL of the site they are about to visit and notice the absence of the proper domain. Something like http://95.32.56.224/to/be/or/not/to/be/sucker.html (example, not an actual link) definitely isn't Paypal, but they don't figure that out until their browser (hopefully) sends up the phishing flag.
Re:LOL. (Score:5, Funny)
Last night, as I leaned over to give my Natalie Portman poster a tender kiss goodnight, I was psychically cast into a hypnotic trance. While entranced, my spirit guides delivered unto me the tale of the Slashdot moderators. Prepare to have your faith in Mr. Malda and moderation shaken to the core.
Difficult as it is to believe, Rob Malda was an outcast teenager. He did well in some of his classes, but was terrible with English. As is so often the tragic case today, his teachers passed him anyway, just to get rid of him. Since Malda had no real life, he spent much of his time on the computer (of course), and watching the public-access cable channel. It was there that Malda heard of the mysterious Mongolian Monks.
Malda was watching his favorite talk show, "Elizabeth Claire Prophet." The guests that night were a group of monks based in Mongolia. The monks described how they had been travelling to China to trade some of their cute teen daughters for Natalie Portman memorabilia. The monks had travelled no more than three days when they noticed a brilliant light in the daytime sky. The light grew larger. And larger. And larger. Soon the sky was completely hidden, from horizon to horizon, by a giant metallic disk.
The monks were taken aboard the craft and placed under some sort of alien mind-control. There, they were given the deepest possible insights into the nature of man, the universe and God. A week later, the alien beings returned the monks to the Earth and vanished forever.
The monks considered the area holy ground and constructed a new temple there, not bothering to return to their old monastery. They took their daughters as wives and began their own commune of worship, based on the teachings of the aliens. The monks practiced meditations which unleashed powerful spiritual forces within them. As the wives bore children, the community grew.
Malda was intrigued by the spiritual insights received by the monks and excited by the idea of incestuous pleasures. Unfortunately, the monks had no internet connection and so Malda could not email them. Without hesitation, Malda booked a flight and left for Mongolia. The plane ride was long and tiring, but his curiosity kept him driven.
After a month of searching, Malda finally located the commune. Initially, he, kept a safe distance, for fear of rejection. He studied the monks from afar. Malda had heard stories of the monks' bizarre meditations, which gave them extraordinary powers. Malda was somewhat skeptical of these stories at first, until he saw the truth first-hand.
In the week that Malda studied the monks, he witnessed the breaking of every natural law. He was astonished as he watched the monks levitate, create pockets of lush weather within the commune and communicated with spirit forces. Malda grew more and more excited and he devised a plan for meeting them.
Malda knew the monks would respect him if he could display his own "magical" powers. He was determined to win their confidence, and he had with him all of the necessary tools. He approached the commune confidently. The monks greeted him with skepticism at the gate. Malda took a deep breath and began his show.
Using an AIBO, a can of Jolt Cola and an inflatable sex doll, Malda shocked the monks with his display of magical powers. The monks accepted him into the commune. Malda's head was shaved and he was given a robe and a room. The monks warned Malda to stay away from their daughters-wives.
The monks methodically taught malda the word of the great messengers. He learned eagerly at first, but soon grew bored with his life in the commune. Malda's life was further stressed when his blow-up doll suffered a puncture-wound and became useless. A few days later, his AIBO's power dried up. With no pet and no woman, Malda slowly
Re:LOL. (Score:5, Funny)
Re:LOL. (Score:5, Funny)
Re: (Score:3, Funny)
for those who missed it (and to avoid the lameness filter) that was a south park reference
Re:LOL. (Score:5, Interesting)
Wow...please install these out-of-date or defunct browsers. So I contacted tech-support to let them know their page was broken, and they actually took the time to *link to the firefox 1.0.7* page, which says it's the most up-to-date version of firefox. When you click the download link, it takes you to mozilla.com where you can download firefox 2. *facepalm*
So after a bit of googling, I found the user agent for firefox 2 on windows (firefox 3's windows user agent *still* wouldn't work) and plugged that into the User Agent Switcher extension. TurboTax worked like a charm after that! All I had to do was lie and say that I was using Firefox 2 on windows instead of firefox 3 on ubuntu.
Re: (Score:3, Funny)
It's a page that deals with doing your taxes. Duh.
Re:LOL. (Score:5, Funny)
Re:Yes. (Score:5, Insightful)
Re:Yes. (Score:5, Insightful)
Re:Yes. (Score:5, Insightful)
Re:Yes. (Score:5, Funny)
Dear god in heaven, please let it be so!
Re:Yes. (Score:5, Funny)
We have those now. They are administered from a testing center in Nigeria. If you fail, your internet is soon cut off for non-payment.
Re: (Score:3, Interesting)
Illiad already had that idea a decade ago. And it was already a good one back then. Unfortunately, how do you want to enforce it?
I wouldn't react with keeping the "dumb" people out. But I would highly recommend (not require, just recommend) that people get some sort of "internet 101, do's and dont's" class before hooking up. I'm honestly amazed that no bank or other financial page ever had the idea of offering s
Re:Yes. (Score:4, Informative)
What's true, though, is that the prophet ain't worth a dime in his own country. Only after I quitted and started consulting, they hired me and took me serious, essentially paying me to tell them the same thing I repeated over and over while i was there. Banks do take security serious. Mainly out of self interest. First of all, the obvious loss of money. But more important even, the possible loss of goodwill. Usually a bank settlement after a fraud takes place can be summed up as "we pay, you shut up".
So whether they're liable for the loss is moot anyway. Paying some moron the 2k he lost when his account was hijacked and ransacked is peanuts compared to bad press. Banks will pay. Even if they keep telling that they won't (this is mostly hoping people will start getting a bit more wary when doing online banking).
Banks already started to acknowledge that there is a problem. Recently we had a week long two page "bank security course" in our major newspaper. To understand the quality of this, you have to know that no paper can write anything the major banks don't want it to write (banks are amongst the most important ad buyers here, piss off the banks and you close your doors). Actually, I know it was some sort of "sponsored report", if you know what I mean.
So appearantly banks did wake up to hear the music. And when you look at their pages, they try to inform about the most recent frauds taking place, but that simply isn't enough. When you do your online banking once a week, you might already have clicked that "give info now or your account is gone" mail, without reading the warning.
What I'd envision is something like a quiz, where you can win a savings account with some token amount of money predeposited if you answer it all right. People like quizzes, especially when you can win something. The selling point would be that your bank does care about your money and your security, something that sells pretty well here (people would rather give you the keys to their home than their banking info, or tell you how much they earn, here).
Re: (Score:3, Funny)
re: But IQ tests filter PayPal, don't they? (Score:3, Informative)
I did... Google Checkout works fine for me as an alternate way to accept credit card payments from people, and seems to cost a littl
Re: (Score:3, Insightful)
If me as a regular user (Pretend at the moment I'm not writing this from my linux laptop) wanted to trade my personal time to assume the responsibility of learning cutting edge counter phishing procedures, then I fail to see the purpose of paying for the service.
From the abo
Re:Yes. (Score:5, Insightful)
But I still stand firm that people are to blame for the lack of security on the Internet. The telephone, the radio, the television, the tabloids, the newspapers, books, and so on were all considered at one time a method of mass disinformation, and some still are to a lesser extent. Why else would we have phrases in our lexicon like "you can't believe everything you read/see on TV/hear on the radio"? Because people are willing to throw caution to the wind. We are more apt to scrutinize and discriminate against information people may throw at us in person, face-to-face, but as soon as the information is put into some form of communication medium, we lose our senses.
We know the guy on the street corner in New York is not selling real Rolex watches; we know the fella that chats you up on the bus is not legitimately selling prescription medications. Even so, we are more apt to believe that these things are available on web sites, because we have it drilled into us that the world is at our finger tips, every thing can be found on the Internet.
If you want to get down to brass tacks and point fingers, WE are to blame for the folly of those who surround us. Yes, WE are to blame. Because WE chose to learn and understand and ignore the plight of those who have not. WE are the shop class instructors letting the uninformed use the table saw without proper instruction and then blaming them when they lose fingers. It is our responsibility to educate and inform others why what they are doing is wrong -- and in many cases we even get paid for doing so.
And I do not mean that using Windows is wrong, but that clicking on email links without thorough scrutiny -- or even at all -- is wrong; that blast-forwarding unconfirmed rumors is wrong; that not understanding that the bank will never send an email and tell you to go to a site and enter all of your vital statistics (and if it does, then you should run like hell, anyway.); that the use of semicolons is ill-advised.
I find it amusing that some of us will take the "duty" to throw out Mom and Dad's Windows PC and replace it with a Linux or Mac box, then walk away pleased with ourselves over the "service" we have just done. When, in fact, the "service" we should be providing is education. It does not matter in front of what box Mom and Dad sit, without the proper knowledge, they are still vulnerable to phishing schemes and exploits.
Really, these so-called idiots out there are mostly just uninformed. Some non-BOFH-type PFY handed them a computer at the WorstBuy, CompUSELESS, or Radio Shanty, without taking the short amount of time it takes to instill a small bit of cynicism over unsolicited or unexpected information and requests. There were no pamphlets at the store explaining how email can be as dangerous as a phone call from "your phone company" or "your bank." Most of these people CAN be taught and guided.
And the ones that cannot will be eliminated one way or another, but of course not before making complete and utter asses of themselves.
Re:Yes. (Score:5, Funny)
Re: (Score:2)
Windows is not to blame for the phishing problem, PEOPLE are. Phishing has been around a lot longer than Windows and Internet Explorer, it was just a lot lower-tech and could not be perpetrated quite as fast.
I am really confused... let's see. Before Windows had "Internet Access" there was OS/2 which beat them out the door with it. Once Windows got Internet access (and before Internet Explorer), there was NetCom, various other dialups and AOL... NetCom and the dialups being one of the few that brought users onto the 'Net...
Then came Netscape (etc)...
...at which time, the Internet was so in it's infancy that phishing (by the definition on Wikipedia and elsewhere) did not exist or barely existed at all. Ther
Re: (Score:2)
Before any of what you mention there was the telephone, mail, fax machines, and more. Fraud schemes abounded long before phishing as we know it today, but the principles were the same: find some way to extract enough useful information from the mark. Phishing is the technological evolution of social engineering, and on a grand scale.
Additionally, in the past when scam spam was rampant, the thought of a botnet was just barely formulated. Such
Re: (Score:3, Interesting)
The only thing that changes is that the fraudsters don't have to be physically at your wallet anymore to steal your cards. ID theft has been around for as long as paying with your ID (be it CC or cash card) has been around. The only thing that changed is that they don't have to steal your card anymore, then phone you, pose as your bank and ask for your secret number to void your card. As stupid as it sounds, people fell for that.
There is one, and only one, th
Re: (Score:3, Insightful)
It's a plot... (Score:3, Insightful)
I always thought this was a plot cooked up by VeriSign and Microsoft anyway. IE gets a cute little green bar that looks like it means something, and VeriSign charges four times as much money for the same certificate.
Re:It's a plot... (Score:5, Insightful)
Not only does it make more money for verisign, but it also raises the bar for retailers so that smaller shops can't afford the same certificate, and thus look to be "less secure" than their larger competitors.
A green bar means nothing, what's really needed is for users to make a white list of the sites they use, then when they visit a scam site it will say "this is a new site you've never visited before" as opposed to "this is paypal, one of your frequently visited sites"... The browser can tell the difference between www.paypal.com and www.p4yp4l.scam.cn, it just needs to communicate that to the user in a sensible way. Users need educating too, i can't believe people are still stupid enough to try logging in to paypal when the url bar contains something completely different.
Also, it should be impossible to change the status bar (that shows where a link points when you hover over it) and mail clients should ALWAYS do something similar, hyperlinks in html can say one thing but point somewhere completely different, and html mail clients are a lot worse at telling that to the user than browsers.
Re: (Score:3, Informative)
More [slashdot.org] information [slashdot.org] here [slashdot.org] and here [slashdot.org].
Re:What If?... (Score:5, Funny)
Wow. That's a rather clever stragegy. I wonder why no one thought of it earlier.
I think they should just get all paypal users to assemble one day (may be in the Arizona
desert) and then teach all of them what you suggested.
Thinking more about it, maybe they should not just restrict themselves to Paypal users -
they should just assemble all internet users & teach them these things.
Re:What If?... (Score:5, Funny)
desert) and then teach all of them what you suggested.
Send out a spam like this:
"I am the widow of a wealthy Arizonan entrepreneur. I am in need of assistance in transferring large sums ($153m) of money. Your help is appreciated. Meet me at the Tuscon desert state park at 8:00 in the evening on April the 19th to complete the transaction. I will give you 25% of the money as a reward for your assistance."
Also:
"Your PayPal account has been deactivated! To reactivate it, you must come to the Tuscon desert park at 8:00 PM on April 19. If you do not proceed, your account will be permanently closed!"
That should get all of the people in need of such education to show up.<g>
Re: (Score:2)
Re:What If?... (Score:5, Interesting)
Re:What If?... (Score:5, Insightful)
Unprincipled people apparently need a fire under their ass before they will willingly broaden their knowledge, expand their experience or otherwise understand anything beyond the superficial level. To me that's quite a shame that they really seem to consider learning, an appreciation for self-reliance, and thinking for yourself to be terribly hard work to be avoided at all costs, rather than a journey of discovery that makes life much less routine and much more interesting. At any rate, if the goal is to remove all incentive to ever actually understand the tools (computers, networks, etc) that we use each day, we are on the right track.
As the saying goes, "A fool and his money are soon parted." Anyone who uses what he does not remotely understand and expects consistently good results qualifies as a fool. For some reason, when a computer is involved this commonsense concept is completely ignored.
Now cue the apologists and their thousand excuses for why literate individuals with no learning disabilities should not be expected to understand the basic concepts behind tools that they decided, of their own free will, to use on a daily basis. It's willful helplessness, plain and simple.
With the increasing social acceptability of this kind of victim mentality, the idea that you are responsible for your own well-being is apparently rather threatening to many people. This is obvious because they tend to give angry emotional responses instead of well-reasoned arguments explaining why they believe I am wrong.
Re:What If?... (Score:4, Insightful)
Knowing how to use the tools offers no protection against scams. Knowing how to use a telephone does not protect you from callers that contact you and attempt to scam you. Knowing how to open a door does not protect you from people who come to your door and try and scam you.
You have a "blame the victim" mentality. It's clearly the fault of the stabbing victim that he got stabbed. He should have jumped out of the way. It's willful helplessness, plain and simple.
Scammers existed long before computers. If you created a free tool that would 100% stop all phishing under all circumstances the scammers would just switch to a different scam. The PROBLEM is the scammers. Period. Crime is the fault of criminals, not the victims.
Re: (Score:2)
In the early days of phishing, every now and then there would be a confusing but authentic looking email from one of my financial institution. Long after I started ignoring anything sent to ME from an institution, they stopped sending out stuff.
Now, if you are smart, ignore anything, log in and get your email messages from the system itself. Much safer that way. Yes, there is man in
Re:What If?... (Score:5, Insightful)
If you understand the basic concepts of how the internet works and apply critical judgment in your transactions, you don't need to have encyclopedic knowledge of every scam in human history -- that's the whole point.
Grandparent also predicted that some would give "angry emotional responses instead of well-reasoned arguments." Nice job proving him right.
Re:What If?... (Score:5, Insightful)
There are many forms of stupidity. For some reason, intelligence keeps getting confused with wisdom. I'm honestly not sure if that confusion is deliberately encouraged in order to obscure the issue or if most people really have no working knowledge of what the difference is. They might both be true.
At any rate, you can have a very high IQ, perform wonderfully at all sorts of logic and mathematics problems, and still be a gullable easily-scammed individual if you refuse to accept that plenty of people do not operate in good faith. You can be very intelligent and still make very stupid decisions. You can be very smart without being humble enough to recognize your limitations and therefore to understand when you are operating outside of your areas of expertise. You can be very smart without understanding that your area of expertise consists of having memorized the ins and outs of a particular inventory of knowledge and that you lack the practical, working knowledge component of true understanding.
You are exactly right. Knowing how to use the telephone shows that you have memorized a small bit of intellectual knowledge. Understanding that there are dishonest people in the world and that therefore, not everyone who calls you is truly who they claim to be demonstrates a working knowledge of the world and of the limitations of the telephone network; that is, a bit of wisdom. So why the need to apologize for people who can't tell the difference? Why send the message that people who have to learn the hard way are victims and therefore are helpless and cannot do better next time at all? Do you believe that you are doing them any favors?
Your analogy is flawed because once someone is stabbed, the laws of physics dictate that there is going to be a wound and it will probably be a serious one. It's not like a stabbing victim can decide "hmm, the point of a knife just struck my body with considerable force... should I let that injure me or not?" This is not the case with a scammer. Just because you receive a phishing attempt, there is no law of physics that forces you to give your personal information to a complete stranger without first performing some due diligence to verify that the stranger is who he/she claims to be. So while you might think you just made some profound point, you have compared an apple to an orange and have effectively made the claim that people must accept everything at face value and believe every lie someone tells them. Is that really your view of the world? Is it really your highest expectation of human capability? I celebrate your right to believe whatever you want, but I cannot support this type of victim mentality; indeed, it seems to be so ingrained into our culture that most people don't even recognize it for what it is.
Re: (Score:2)
Part of knowing how to use a browser is knowing how to parse URLs. That's unfortunate, but I think it makes more sense to blame browser makers (and perhaps also users) than to blame criminals in this case.
Re: (Score:2)
Disagree a little here. I don't believe a computer is necessary for common sense to be ignored, just an endocrine system.
Re: (Score:2)
This is why I'm very careful whenever someone wants to pay me a large amount via PayPal. I usually prefer a check or direct deposit.
Education? Hardly a solution! (Score:2)
1) It takes time and effort for everyone involved
2) There will always be people who don't get it
3) There will always be newcomers
Yes, "knowing" is a good thing. However it is something the educated often take for granted because they believe the problem only applies to the uneducated, and they aren't the one's responsible for the education. Well, if it did apply to you you would be "surprised", and if you had to do the teaching, you'd try and think of something else once you realized what a waste
Re: (Score:2, Insightful)
Re: (Score:2)
With an education campaign? No. A campaign is precisely the sort of one-to-many communication that presumes that your education (and therefore your well-being) is someone else's job. Did you not read my post? That needless dependence on someone else to look out for your own interests is exactly what I am against. It is the one thing that makes all the other problems possible, which is
Still vulnerable to phishing... (Score:5, Insightful)
After much consideration, we've determined that your browser is safe again! Please log in at http://127.0.0.1/some/unsafe/address/ [127.0.0.1].
PayPal apologizes deeply for the inconvenience.
Re:Still vulnerable to phishing... (Score:5, Funny)
But back up a bit and you get the whole directory structure. TONS of porn in a couple folders.
Re: (Score:3, Funny)
Please go to http://www.whatismyip.org/ [whatismyip.org] and copy and paste your IP address into a reply e-mail.
PayPal thanks you for your time and effort.
Re: (Score:2, Funny)
http://www.electric-escape.net/node/1475 [electric-escape.net]
http://www.thehumorarchives.com/joke/IRC_Idiot [thehumorarchives.com]
Re: (Score:2)
Re: (Score:2)
You can't always get end user public IP address if they are NAT'ed.
I think paypal should just quadruple their usage fees for those users instead of banning them, then get rid of the fees for the rest of us. If people are retarded enough to use a Mac (Safari) or other unsafe browser then they are probably easily persuaded to pay the additional fees for no reason other than
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Funny)
Re:Still vulnerable to phishing... (Score:5, Funny)
Another one... (Score:2, Funny)
Due to recent security upgrades, you may no longer be able to log in. In order to give all our customers the highest level of protection against fraud and identity theft, we are requiring that you have up-to-date security measures on your computer.
Please install the enclosed program [malware.exe] to upgrade the security of your computer to ensure that you can continue to access your PayPal account.
Thank you,
- Scams R. Us
Benefits for Everyone Else (Score:2, Insightful)
User Agent Change (Score:5, Interesting)
Preferences > Advanced > "Show Develop Menu in Menu Bar"
Develop > User Agent > Firefox 2.0.0.12
Suck it > Paypal
Re: (Score:2)
Thanks, Macbuzz. It's done and done!
Re: (Score:3, Informative)
Really, I'd love to see someone knock PayPal out of the spotlight. For those of us without credit cards, it's usually the only option.
Re: (Score:2)
http://images.appleinsider.com/leopard-9A283-anti-phish.jpg [appleinsider.com]
OK so far so good (Score:3, Funny)
Technically inclined user defeats barrier to... (Score:4, Funny)
Well... (Score:2)
I have an idea... (Score:5, Insightful)
Netcraft seems to have a slightly different take (Score:5, Insightful)
Extended Validation certificates and XSS considered harmful [netcraft.com]
Curious if nothing else.
Re:Netcraft seems to have a slightly different tak (Score:5, Funny)
Who are they to decide what is and isn't safe? (Score:5, Insightful)
Is this even legal? Seriously. If someone has money in PayPal, and if that same someone happens to be using a browser that is deemed "unsafe" and is sequentially banned, isn't that like PayPal holding the money hostage? What happens to those who refuse to "upgrade" in order to access their account?
Maybe instead of doing stupid stuff like this, which breeds a false sense of security among some less-smart users of PayPal, they should think of new and innovative ways to prevent unauthorized access to accounts. (I don't care to list my ideas right now.)
Re: (Score:2, Troll)
Paypal doesn't give a shit about anything but making money from themselves, and don't hesitate to take money from anybodys account for almost any reason.
PayPalSucks.com [paypalsucks.com]
It is kind of silly, forcing people to access PayPal with secure browsers when money stored at PayPal isn't secure from PayPal itself.
(PayPal isn't a bank, nor does it even try to pretend to be one, so don't let them have any EFT account numbers, and never store any money there.)
Re: (Score:2)
Does it have fishing protection?
yes = allow
no=recommend one that does.
OFC its legal, they're not forcing you to pay anybody anything, and people have been forced to use a certain browser for sites for years. hopefully they will do it via user strings, and assume anybody that is smart enough to fake a userstring is smart enough to not get phished.
Re: (Score:2, Insightful)
Not the same. They certainly would care if their customers lose money - PayPal isn't the only fish in the online payment sea, though it is the largest. If phishing becomes too common it impacts their image and reputation as a safe way to shop.
And of course it's legal. Considering at least one allowed browser is FREE, and is available to basically every platform out there (Firefox), there's no burden on the consumer to have a "safe" browser.
That's like complaining that your bank inconveniences bike riders by
Re: (Score:2)
That's what I was thinking, sort of. Requiring a "safe" browser seems about as effective as the TSA - some bogies get through, some grannies get nailed.
What about Lynx? (Score:5, Funny)
How about the other way around? (Score:5, Insightful)
First, Ebay Should BAN Sending Email to Users (Score:5, Insightful)
Instead of banning browsers, Ebay should address the bigger security issue of Ebay sending email to users - instead Ebay should only send notices simply saying one has new messages in their Ebay message center, and require the user to actually visit Ebay to view the message contents - not fool-proof, but would substantially reduce the effectiveness of email spoofs.
Ron
Re:First, Ebay Should BAN Sending Email to Users (Score:5, Insightful)
There is a new message waiting for you. You may login into here [slashdot.org] to access it.
Sincerely,
eBay Scammer.
Re:First, Ebay Should BAN Sending Email to Users (Score:4, Insightful)
One very important thing they would have to do is include some sort of identifying information, otherwise this would open the door to some very easy phishing attacks (as per Nushio's sibling comment).
Perhaps in your eBay account, you could choose one from several thousand little pictures (e.g., as you do with video games and video game systems to choose an avatar picture). Then, the messages could read something like:
Then again, I think things like this have been tried before (don't some banks do something similar to this when you log in?) I guess if the users don't care to pay attention, they won't notice the difference between what I wrote above and:
Re: (Score:2)
Personally, I think this is a great thing. Finally, people will have major incentive to upgrade from IE5 and 6, the bane of web developers.
How much does it cost to become a "safe" browser? (Score:2)
Wow, PayPal has figured out #2!
1) Declare a browser as "unsafe"
2) ???^H^H^H^H^H^H
2) Block the browser from your popular site
3) Profit! --> Approach the company that makes the browser... "we'll declare it safe... for a price".
How valuable are EV SSL certs? (Score:5, Interesting)
I have attended several of the webinars and read a number of the white papers on EV SSL certificates, and I am not completely sold on the usefulness.
Sure, thorough validation of a requester's right to purchase an SSL certificate is a good idea. That should be done already for any SSL purchase, but it is and will not be done because it makes the process too difficult, time consuming, and expensive. Well, too expensive for GoDaddy to sell a $20 certificate and thoroughly validate it, but for the $350+ Verisign certificates? Please...
More to the point, older browser showed a lock icon which indicated the site was secure. With the ease of SSL certificate purchases that quickly became less important because even phishing sites can have valid certificates. The EV SLL scheme is to put up a BIG GREEN BAR with the issued company's name in it. Why not just do that anyway? Those notification bars that come up when a pop-up is blocked, or an ActiveX control wants to install, or a file wants to download; how about use that to show critical information in the certificate, like the CN?
Sure, the URL says www.paypal.com, but the certificate CN says "www.phishingurinfoz.ru".
But then, I suppose a little Java and no protection of that particular window element could lead to a phalse display.
Re: (Score:2)
Sure, the URL says www.paypal.com, but the certificate CN says "www.phishingurinfoz.ru".
Sure, the URL says www.paypal.com, but the certificate CN says "www.paypa1.com".
Sure, the URL says www.paypal.com, but the certificate CN says "wwwpaypal.com".
Sure, the URL says www.paypal.com, but the certificate CN says "www.paypals.com".
Sure, the URL says www.paypal.com, but the certificate CN says "www.baypal.com".
That'll be more than enough to fool some of the people all of the time.
How about this? (Score:3, Insightful)
Re: (Score:2)
Paypa
1 more step to go. (Score:2)
Paypal blocks unsafe browsers... (Score:5, Funny)
stupid and pointless (Score:4, Insightful)
The problem isn't "unsafe browsers". Phishing is social engineering, not hacking. The problem is unsafe users.
Give a stupid user a safe browser and a semi-sophisticated phish and they'll cough up that login.
Give a smart user a IE 5.0 and they'll never get busted.
If paypal really wanted to increase user safety they'd do it with user education.
Tell users to very carefully navigate to the correct site, make a bookmark, and then never go to the site any other way again.
Will take my business elsewhere (Score:2, Interesting)
Re: (Score:2)
Easy Phish - Thank you Paypal (Score:5, Funny)
Have no fear.. with paypalproxy.com you can use any browser to access your account.
--
So long and thanks for all the phish.
I am an unhappy customer (Score:5, Insightful)
Re: (Score:3, Informative)
If Paypal wanted to slow phishers (Score:3, Interesting)
Paypal should send out official looking emails with links to a site that isn't on Paypal.
If someone enters their information on this fake site, Paypal would warn them that they got phished and released!
Paypal could tell them important stuff like only manually going into paypal.com and never clicking on a link in an email.
Lazy Unregulated Global Banking Monopoly (Score:2)
All these banks should be doing that. The FBI should be busy protecting us from these modern bank robbers, not all the domestic snooping and other abuses they waste their time and our money on.
Trademark holders are supposed to lose their trademarks when they don't defend them against imitators. Banks are supposed to sec
Prime example (Score:5, Insightful)
Ironically, phishing sites won't block users using "unsafe" browsers, which just makes them more user-friendly than paypal.
What's the point? (Score:4, Insightful)
There are four scenarios, assuming we agree to what "safe" is.
The immediate result is only affecting scenario 2, so there will be some loss of business.
In the long run, paypal expects users who hit the scenario 2 to switch to a safe browser. And paypal is big and important enough (whether we like it or not) for a reasonable number of users to do the switch.
Comment removed (Score:3, Insightful)
Stupid (Score:3, Interesting)
If they were really being consistent... (Score:3, Insightful)
No matter what soi-disant "security features" Microsoft implements, the fundamental design of IE is inherently insecure, and it can not be made secure without making deep changes in the API that will cause Microsoft to lose too much face to go through with it.
Open letter to PayPal (Score:4, Interesting)
I use PayPal right now because it is one of the more secure options out there. I give my financial details to one party (PayPal) instead of every site I do business with -- which means PayPal gives me the opportunity to review every single transaction, and approve or deny.
It's also nice and reassuring to visit www.paypal.com, and see an https URL the whole way through -- knowing nothing important is ever transmitted in the clear.
And for some small amount of money -- I forget exactly how much it is, but relatively cheap -- I can even get a physical security token, which, I believe, is also valid with VeriSign. And due to its implementation, this token requires no additional software -- I just read a number off the token and into a browser window. What's not to like?
These are the reasons a highly technical and security-conscious person might want to use PayPal. Highly secure, with a lot of control and choice.
Now, I can understand wanting to protect the less-technical users. Send them emails every now and then, telling them not to click links in emails. Warn them if they're not using a secure browser. Provide technical support, walkthroughs, and as much hand-holding as you like.
But please don't alienate those of us who know what we are doing by removing our choice. Don't block browsers simply for not supporting anti-phishing, or having it disabled -- some of us know how to read the address bar, and value our privacy. Block older, actually vulnerable browsers if you must, but do not make it a whitelist.
The day I have to turn on user-agent spoofing to get to my money is the day I take my money somewhere else.
Re:Banks should do this. (Score:5, Insightful)
Are you nuts?
"We're sorry. You're not using IE. And if you are using IE, your IE configuration isn't permitting us to run the MegabanX proprietary ActiveX control that our conslutants [sic] told us would eliminate all our liability. Please enable ActiveX support in order to continue banking with us, or turn off that Netscape thingy and upgrade to IE4.0 and resize your window to 800x600 while you're at it."
Forgive me for the sarcasm, but I had to switch banks twice because of that sort of crap. Think back a few years. The last thing any of us would have wanted "since they introduced internet banking" was our banks doing User-Agent and Javashit-based snooping on our configuration.
Re:What about older OSes? (Score:4, Informative)
Firefox works as far back as Windows 95 IIRC? I installed Firefox on my uncle's Windows 98 box, the only issue was that the start bar title icon didn't show up properly but it ran.
Sure he can't use his iPod with Windows 98, but Firefox works great. If he gets a RAM upgrade he can run Windows 2000. But technically with 128M of RAM or more he can run Windows XP on his 333Mhz processor, but it will be really slow.
I don't think we can afford to buy a new machine, and his old machine runs great.