If the user doesn't click the link in their email, it doesn't matter whether or not they pay attention to padlock icons, or if they think the site is safe because it's got a favicon. (obviously those things are still issues for other reasons however.)

Trying to address the phishing problem by fixing the web UI doesn't make sense to me when the real problem is a step or two before they get to the website.

With that in mind, one of the best ways I can think of to help users avoid phishing is to have them read email in plain text.

Doing so would make it readily apparent (to html savvy users) that the link is false, and users that can't read the html code would just see a bunch of gobbledygook and be likely to ignore the message.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/405/33692#33692