> Agreed but forcing phishers to generate key pairs, purchase
> certificates, and/or buy-off CA vendor personnel creates additional
> audit trails that could help in the tracking and prosecution of those
> individuals. Combine this with certificate revocation and you have at
> least a model that gives more verification, auditing, and remediation
> than currently exists in the pursuit of these criminals. It's at least a
> step in the right direction and shouldn't be avoided simply because it
> won't immediately stop all phishing attacks or protect all users.
>
> Watermarks do not stop all counterfeiting. Holograms do not stop all
> credit card fraud. It doesn't mean we shouldn't do what we can to help -
> even if its only a partial solution.

Phishing relies on the victim lacking the information or the intellectual
capability to distinguish genuine email or web page from a fake one. That is
why phishers attempt to use nearly-real URLs and shiny padlock icons so that
the user feels a false sense of security and correctness when he sends in
his social security number. If a phishing email is signed correctly, the
email client will display a padlock icon on its own plus assurances that the
email has been signed and valid and authenticated, etc. All this will
further the false sense of security that phishing relies on, unless the
email client is configured to explicitly display enough information on the
signature and enough warnings for the average user to be able to make an
informed decision.

Philip

[ reply ]