I think you need to read the paper more carefully. It wasn't just the "low hanging fruit" get taken, the researchers found that there was very little difference in vulnerability between the second least sophisticated category and most sophisticated category of users. Alarmingly, even "Type 5 users" -- users who were smart enough to drill down into X.509 certificates, do whois searches, etc. -- were fooled 30% of the time!!!

There is a serious risk here of underestimating just how sophisticated the latest generation of phishers are.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/176/861#861