Pharewell to Phishing
The conventional wisdom has always been that users should refrain from entering their sensitive data (such as usernames, passwords, and credit card numbers) into http(or white) pages, but they can enter these data into https (or yellow) pages. Unfortunately, this assumption is not valid as it became clear recently that, through human mistakes or Phishing or Pharming attacks, a displayed yellow page may not be the same one that the user has intended to request in the first place. In this paper, we propose to add a third class of secure web pages called brown pages. We show that brown pages are more secure than yellow pages especially in face of human mistakes and Phishing and Pharming attacks. Thus users can enter their sensitive data into brown pages without worry. We present a login protocol, called the Transport Login Protocol or TLP for short. An https web page that is displayed on the browser is classified brown by the browser if and only if this web page has been called into the browser either through TLP or from within another brown page that had been called earlier into the browser through TLP.
Unable to display preview. Download preview PDF.
- 1.Ollmann, G.: The Pharming Guide, http://www.ngssoftware.com/papers/ThePharmingGuide.pdf
- 2.Dhamija, R., Tygar, J., Hearst, M.: Why Phishing Works. In: The Proceedings of the Conference on Human Factors in Computing Systems (CHI 2006) (2006)Google Scholar
- 3.Group, A.P.W.: Phising activity trends report, (September 2007), http://www.antiphishing.org/reports/apwg_report_sept_2007.pdf
- 4.McMillan, R.: Gartner: Consumers to lose $2.8 billion to phishers in 2006 (2006), http://www.networkworld.com/news/2006/110906-gartner-consumers-to-lose-28b.html
- 5.Blake-Wilson, S., Nystrom, M., Hopwood, D., Mikkelsen, J., Wright, T.: Transport Layer Security (TLS) Extensions. RFC 4366 (Proposed Standard) (April 2006)Google Scholar
- 6.Franco, R.: Website identification and extended validation certificates in IE7 and other browsers. IEBlog (November 2005)Google Scholar
- 7.PassMark Security, http://www.passmarksecurity.com
- 8.Bank of America, http://www.bankofamerica.com/privacy/sitekey/
- 9.Wu, T.: The Secure Remote Password Protocol. In: Proceedings of the 1998 Internet Society Network and Distributed System Security Symposium, pp. 97–111 (1998)Google Scholar
- 10.Wu, T.: SRP-6: Improvements and Refinements to the Secure Remote Password Protocol. Submission to the IEEE P1363 Working GroupGoogle Scholar
- 11.Gabber, E., Gibbons, P.B., Matias, Y., Mayer, A.: A Convenient Method for Securely Managing Passwords. In: Financial Cryptography (Feburuary 1997)Google Scholar
- 13.Halderman, J.A., Waters, B., Felten, E.W.: A Convenient Method for Securely Managing Passwords. In: 14th International World Wide Web Conference (May 2005)Google Scholar
- 16.Choi, T., Son, S., Gouda, M.G.: Pharwell to Phishing: Secure Direction and Redirection over the Web. Technical Report TR-08-19, Austin, TX, USA (April 2008)Google Scholar