WebApp Sec: Re: Article - A solution to phishing

[Mark Burnett <mb () xato net>]

I have been watching this thread with great interest and although the basic concept that Michael describes is 
interesting and might help reduce phishing, as others have pointed out it is still vulnerable to a number of other 
threats and heavily depends on a number of assumptions that might not be realistic.

Nevertheless, the fundamental issue with phishing is not that an attacker can obtain your credentials, but that an 
attacker can trick a user into entering credentials in a fake web form. This is because it is easy to create a fake web 
site that looks exactly like the original and it is easy to direct the user to that site using deceptive links in 
e-mails, browser vulnerabilities, DNS spoofing or poisoning, ARP spoofing, stealth proxies, cross-site scripting, HOSTS 
file modification, bookmark modification, trojans, social engineering, etc. 

Protecting authentication credentials is also a problem, but the solution to phishing is more one of authenticating the 
site rather than authenticating the user. First solving the issue of authenticating the site makes it easier to solve 
the problem of authenticating the user.


Mark Burnett


------------------------------------------------------------------
Hacking the Code: ASP.NET Web Application Security
http://www.hackingthecode.com