Another idiot^W reader who didn't bother to read the actual paper. It turns out that you DON'T need to be n00b and stupid, the latest phishing efforts are so slick they fool even very smart users (people who understand how to parse X.509 certs and do whois searches) who have just been warned that there is a ~50% chance the site they are looking at is faked. Under those circumstances, even the MOST sophisticated users were fooled THIRTY PERCENT of the time.

The current total system -- security infrastructure, web site design and business rules, browser interfaces -- is just not up to the job. It is not ready for internet commerce, and if you think phishing is only for fools and you're too smart for the bad guys, you will probably be their next victim.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/176/867#867