Netcraft Releases Anti-Phishing Toolbar

AgainstHate writes "Netcraft has released an Anti-Phishing Toolbar that provides detailed information about the website you are visiting (sites' hosting location, country, longevity and popularity) at all times to help users to validate fraudulent URLs. It also natively traps cross site scripting and other suspicious URLs. The toolbar also enables users to report phishing attacks to Netcraft, thus blocking any other unsuspecting users from being harmed (Netcraft supervisor validation is used to contain the impact of any false reporting). Currently the toolbar is only available for IE but a Firefox version is under development."

Comments

Nostradamus Predicts

[the_mad_poster]

This will have little affect because:

1) The people who really need it will never hear about it.

2) Even if 1 fails to return true, the people who really need it will never be able to find it amongst the 82 other toolbars that various companies have so helpfully installed for the sucke.... uh... users.

Re:Nostradamus Predicts

[Gentlewhisper]

They really don't need a firefox version anyway..

People who use firefox fall under those who don't really need it :)

Re:Nostradamus Predicts

[The Snowman]

They really don't need a firefox version anyway..

People who use firefox fall under those who don't really need it :)

Maybe for the time being. Right now, Firefox largely is a geek browser. However, recent news shows that it is becoming more popular and mainstream. Software can only do so much to curb user ignorance. Firefox is not perfect, nor does it stop phishing and other scams. Plugins, such as this toolbar, could help prevent Joe Sixpack from scammers and phishers. After seeing enough message boxes about malicious sites, hopefully he will learn the skills he needs so he will not need the toolbar anymore.

If Firefox does not keep the scammers and phishers away, new users will abandon it and go back to what they already know: IE.

Re:Nostradamus Predicts

[the_mad_poster]

Not true at all. I happen to be the proud owner of a very serious exploit in the shopping cart of a major online retailer - an exploit of a simple-fix problem they refuse to even look at.

The gist is this - there's a variable in the GET string of the cart which does no input sanitization or checking at all. I derived a GET string which caused an invisible iframe to be embedded in the shopping cart page of this retailer. Inside the iframe, however, was a page pointing to one of my sites on which a fake form resided. The page/form claimed you would "Get a free gift for only 99 cents S&H" and asked for name, address, phone number, and credit card. The ONLY indicator that it's fake is:

1. The hard to read GET string which, if you know HTML and the concept of CGI, you could figure out points to a "bad" page if you looked at it.

2. The javascript alert that says "owned" after you click the "submit" button.

I even photoshopped some of their own button graphics and used their CSS files to maintain the look of the site.

They have yet, after almost a year, to fix the problem.

Firefox is just as vulnerable as anything else, and this particularly nasty XSS attack was fairly hard to detect. Do not rely on your browser to save you from yourself.

Re:Nostradamus Predicts

[Sfing_ter]

the proper term is "lusers"

Re:Nostradamus Predicts

[hendridm]

Perhaps, but at least those of us who setup our friends and family can install it. My parents use Firefox, but my inlaws want IE and run XP SP2 (popup blocking), so they may be a candidate for this and I can install it for them. Plus, my mother-in-law actually reads her spam, so maybe this is just what she needs :P.

Re:Nostradamus Predicts

[RangerRick98]

Software can only do so much to curb user ignorance.

You make the point very well right there. I don't care what features a browser includes to curb scamming and phishing and the like, if the users don't pay attention to what they're doing it won't make a bit of difference. Toolbars are out of the way and require a conscious decision to check them, and so they probably won't do any good, and popup messages are so common for the most mundane of errors that a lot of users I know won't even read it before clicking OK, even if it's a popup they know they haven't seen before.

Users need to learn not to assume their computer and the Internet are safe and instead educate themselves on how to recognize scams themselves.

Re:Nostradamus Predicts

[computational super]

Hmmmm... I'm almost afraid to admit this, but I'm a Firefox user who might be able to use this. There's a lot of information there that I've never been able to figure out how to determine using publicly available resources. According to TFA, Netcraft will report site, domain, ip address, country, date first seen, organization, last reboot, netblock owner, site rank, name server, DNS admin, and reverse DNS. Obviously I can use nslookup to figure out the IP address, and internic.net to look up the domain and figure out name server, dns admin, etc. but country? netblock owner? Date first seen?

The example shown in TFA, for example, shows netcraft.com being hosted in the UK... obviously, this is more sophisticated than just checking to see if the domain is co.uk. It seems like they actually are providing some value by maintaining a database... figuring out the hosting country from an IP address is supposed to be impossible.

Of course, I'm not downloading anything until I've seen it reviewed for a while to see if the database they're maintaining is useful in any way, shape or form - if 99% of the sites aren't in their database (and they're just showing me WHOIS lookups), then yeah, I guess I fall into the "don't really need it" category.

Re:Nostradamus Predicts

[The Snowman]

Users need to learn not to assume their computer and the Internet are safe and instead educate themselves on how to recognize scams themselves.

Yes, but users don't always want to learn. The old saying "ignorance is bliss" is true. Maybe I am jaded from dealing with computer customers and users for so long, but I think most people really don't want to learn those skills. They would rather have someone else or the software do it.

Most people would rather have someone else change the oil in their cars, even though it takes 10 minutes and half the money than professionals charge. I have changed stuff like alternators, lights, belts, etc. for far less money than professionals would charge. However, most people do not want to spend the time to learn how. Just the same, people would rather trust the professionals to keep them safe in their web browser rather than learning how to do it themselves.

Re:Nostradamus Predicts

[Anonymous Coward]

I really hope your example isn't still publicly accesible. Otherwise, they might just be waiting to prosecute you before fixing it.

Re:Nostradamus Predicts

[Feyr]

date first seen is probably pulled from netcraft's database

netblock owner and country is from a whois on arin/ripe/apnic 's whois servers

Re:Nostradamus Predicts

[RangerRick98]

Yes, but users don't always want to learn

That's very true. I don't know why there's this mentality among users that the computer is responsible for keeping all the bad guys out while letting the good stuff in and requiring no human component to that. I can't come up with a good analogy to explain my point, but why is it that computers are expected to be able to fend for themselves and protect their users when no other product has the same responsibility?

Re:Nostradamus Predicts

[the_mad_poster]

The exploit was never made publicly accesible, and now it's not even on the web anymore. I even kept it in a directory that wasn't spidered, just in case.

Of course, if someone else finds the flaw and uses it against them, the imbeciles will probably blame me anyway. Heaven forfend some overpaid guru-wannabe with some ASP "skill" should get off his fat, cheeto-eating ass and actually spend five minutes fixing the bloody problem when you can just sue people for your own incompetence instead.

Re:Nostradamus Predicts

[EpsCylonB]

1) The people who really need it will never hear about it.

My first reaction to this was similar, shouldn't this be built into the browser ?.

Re:Nostradamus Predicts

[PainBot]

And who really needs it then ?
As far as I know, there are a few cross-site scripts that will fool many people.
I don't know about you all, but I don't consider myself as the dumbest of users, yet I'm pretty sure I'd fall in some of the most vicious traps.

Just because you know about it doesn't know you won't be another victim.

Re:Nostradamus Predicts

[t_pet422]

They really don't need a firefox version anyway..

People who use firefox fall under those who don't really need it :)

Not true at all. I installed Firefox on my parents' computer and told them, "Use this, it's the best web browser, don't use IE." They took my advice (it makes me proud). I'm sure I'm not the only tech-guy/Firefox advocate who did this.

Re:Nostradamus Predicts

[xpyr]

actually a better analogy is that users who don't want to learn how to protect themselves while they use their computer to go on the internet is the same thing as drivers who when they're driving will go through a red light over and over even though they're not supposed to. Now usually that doesn't happen because the percieved danger is their and is greater to the driver if they do that alot. Now computer users on the other hand don't recognize the amount of danger that things like phishing scams and spyware can cause because it's more of an invisible threat and doesn't impact their use on the computer right away the same way a driver going through a red light would cause an accident right away and the driver would understand that if he continued doing that, more accidents could occur. Ignorance is bliss with most computer users it seems and just makes me want to slap them upside the head. :)

Re:Nostradamus Predicts

[sootman]

"They really don't need a firefox version anyway.. People who use firefox fall under those who don't really need it :)"

Oh yeah? How did you do on this quiz?

Re:Nostradamus Predicts

[Anonymous Coward]

If I drive a car on a road, it's reasonable for me to expect the vehicle to not erode and become unusable because I decided to take it out of the driveway.

Re:Nostradamus Predicts

[Erasei]

Maybe for the time being. Right now, Firefox largely is a geek browser. However, recent news shows that it is becoming more popular and mainstream.

This really hit home with me over the Christmas holidays. I was down in Arkansas visiting relatives (I'm out of Chicago now), and I overheard two of my uncles talking about "Fox Fire, or something like that". Turns out that one of my uncles had already switched to Firefox AND Thunderbird. He had never heard of tabbed browsing, he was just tired of the "crap from Explorer all the time". These guys are farmers and factory workers, not even remotely 'geeky'. Since getting back home two of the other uncles involved in the coversation have emailled me to ask about switching to Firefox as well. Simply amazing to me. How our little foxy has grown.

Re:Nostradamus Predicts

[Anonymous Coward]

"After seeing enough message boxes about malicious sites, hopefully he will learn the skills he needs so he will not need the toolbar anymore."

No, he'll learn to become dependent on the message boxes. This is similar to autocomplete. It doesn't teach you to type better, it teaches you to type bad and rely on the computer to fix it for you.

Re:Nostradamus Predicts

[akad0nric0]

Users need to learn not to assume their computer and the Internet are safe and instead educate themselves on how to recognize scams themselves.

The problem with this logic is that the phishing scams are so good, many "educated" users can't tell the difference. Take for instance the phishing scams that pop-up an image over the URL bar (with no borders) that makes the page look like http://www.citibank.com/ with a login page identical to the real thing. Of course, in the real URL bar, www.hackers-r-us.com shows up, but it's covered with the image of a legitimate URL. You can't expect users to be able to identify this, and you can't really call this user ignorance...

What I wonder is how long this will be effective, before phishers find ways around the toolbars (assuming they catch on in the first place). This arms race continues to underscore what I see as the root of the problem: poor coding that allows many of these tricks like the one mentioned above to happen in the first place.

Re:Nostradamus Predicts

[realdpk]

Huh. What a bizarre quiz.

"We're back with 10 new suspect "phish" fresh from our collection - all actually received by real people like you. Whether you're brand new or a repeat tester, the question is the same: If you received one of these emails in your inbox - what would you do?"

My answer is, of course, I'd read it if it was related to a company I do business with, and then go to their website (on my own) to find out what's going on. I would not ever click a link in the email. Parsing emails for HTML is about the most braindead thing ever.

Re:Nostradamus Predicts

[ubernoob22]

However, most people do not want to spend the time to learn how It's almost as if, at some point in their lives, people decided to stop thinking for themselves.

Re:Nostradamus Predicts

[Not_Wiggins]

Yes, but users don't always want to learn. The old saying "ignorance is bliss" is true.

More to the point, once you put a "trusted and automatic" mechanism in place, it won't take long before that gets exploited such that scammers will have people falsely believing they are safe. I think that situation is infinitely worse.

As my ju-jutsu sensei used to say, the fundamental problem is that people want to live in a constant state of "condition green" (everything is reasonably safe, except for the odd natural disaster) instead of the more realistic "condition yellow" (one must be on alert because there may be danger around).

The media promotes "condition red" (we're under constant attack).

Some people might think that by hitting both extremes you wind up somewhere in the middle. For computer safety and safe internet usage, that doesn't appear to be the case. Instead, you have those who are either overly paranoid or underly paranoid.

I fear that the media push towards "you should be overly paranoid" has Joe Average User swinging back the other way: "I want to have an experience that is always safe that I don't have to think or worry about 'bad people'."

And despite the fact that that situation can never exist, people are still trying to satiate that desire by coming up with these "automatic protections."

While at first blush this toolbar looks like a good idea, I fear it will ultimately do more harm than good.

Re:Nostradamus Predicts

[Twanfox]

Hopefully there are sane judges and juries that understand the notion that if you inform a software company of a flaw and they fail to fix it for over a year, that if an exploit ever does become public, the fault lies with the software company (that did nothing to remedy the problem, dispite having far more than ample time to do so) instead of the discoverer (that did the responsible thing by reporting the flaw to the maker of the software).

Re:Nostradamus Predicts

[DrEldarion]

1) The people who really need it will never hear about it.

I put a link up to this with the sole description as "If you don't know what this is, you probably need it." I find that ambiguity sparks interest, which will get people who normally wouldn't care to read about it, which will hopefully lead them to say "Hey, I guess I do need this."

This typically works a lot better than saying "You need this", which makes a lot of the clueless users say "oh, yeah, okay, I'll get right on that."

Re:Nostradamus Predicts

[TobiasSodergren]

When download servers points to sites that does not have a fqdn, e.g. when downloading mozilla, do you pay attention?

Re:Nostradamus Predicts

[the_mad_poster]

Except, for people to treat their cars the way they do their computers, they'd have to:

• Never get an oil change. Ever. Everytime the oil burned into the pan and the car stopped running altogether, they'd just replace the whole pan and rebuild the block to clean the ooze out. They would also whine incessantly about having to do this.
• Never check their tire pressure. Ever. They would simply drive the car until the tires blew, then continue to drive on the rims complaing about how hard it is to control.
• Drive the cars around bad neighbordhoods all the time without taking any precautions. When they get caught in a drive by, or someone comes along and smashes up their car, they'd whine about the car getting damaged as if it were the car's fault.
• Everytime someone offered to install something, they'd do it. This would include everything from cutesy stickers with corrosive backing to "engine upgrades" that make the car go half as fast, but lets you change the color of your headlights. All negative affects would, again, be blamed on the car.

Computers are complex tools that require maintenance. Hell, some people pay more attention to their toaster's maintenance than the computer's maintenance. At least they clean the damn crumbs out of it from time to time.

Re:Nostradamus Predicts

[Anonymous Coward]

Oh please tell me it is amazon!

Re:Nostradamus Predicts

[Anonymous Coward]

I don't change the oil in my car because I'd rather waste thirty bucks and ten minutes out of my day than risk having one of those crappy jacks give out and have my car fall onto me. Not everybody can afford the proper equipment to do their own oil changes, nor do most people have level driveways that would enable them to do a safe oil change with the junk they sell at AutoZone.

Re:Nostradamus Predicts

[dbacher]

The toolbar has a feature (not mentioned in the synapsis, but mentioned prominently in the download) that it does not require you to look at the toolbar to prevent phishing.

When an experienced user (/. reader, for example) receives a phishing link, they can report the phishing link. When there are enough reports (I don't know what enough is, didn't see it on the page), they block the site.

That is, if the site is in a known list of phishing web sites, you cannot browse it.

So this is very real protection for inexperienced users, as long as experienced users take the responsibility of reporting phishing attempts.

Re:Nostradamus Predicts

[dbacher]

The thing you left out is that it also blocks reported phishing sites. One point the site makes strongly is that phishing operates by sending billions of messages and hoping for a small number of hits.

If responsible, experienced users using the toolbar were to actually report the phishing links, the inexperienced users likely to be vulnerable to it would be very well protected.

Re:Nostradamus Predicts

[RangerRick98]

phishing scams that pop-up an image over the URL bar (with no borders)

In this case I will say 100% that that is a problem with the web browser and clearly needs to be remedied in the software. No browser should allow a site to mask its URL. Most phishing scams I've heard of are less sophisticated than that, but then again, it's been a while since I've had to deal with them.

Re:Nostradamus Predicts

[betelgeuse68]

I have to agree. Casual end users are largely ignorant and rather blissful about the Net. This is also complicated by over eager kids in some househods to click on "Yes" to anything that pops up and/or are installing thus facilitating the compromise of computers.

Security and convenience are inversely proportional to each other.

Until the consequences of ignorance start exceeding those of convenience the status quo will continue to exist.

-M

Re:Nostradamus Predicts

[RangerRick98]

When download servers points to sites that does not have a fqdn, e.g. when downloading mozilla, do you pay attention?

I do, yes, but I see your point.

Re:Nostradamus Predicts

[RangerRick98]

The toolbar has a feature...When there are enough reports [against a phishing site], they block the site.

Ah, obviously I didn't RTFA. That idea shows promise, as it implies a community-supported effort, and I'm a fan of things like that. I'm primarily concerned, though, that users will begin using tools like this as a crutch and put less (if any) effort into critical thinking to identify a phishing site on their own.

Re:Nostradamus Predicts

[The Spoonman]

Actually, in a way, they already have it...SpoofStick is an extension that'll help detect spoofed sites.

Re:Nostradamus Predicts

[rf600r]

Don't come in here ruining the joke with your logic and insight. We just won't be having it.

Re:Nostradamus Predicts

[narad]

Yeah, most people who use firefox are intelligent enough to stay away from those phishing sites. But at the same time, I have an apple and the only browser I have installed is Firefox and sometime's my innocent family shares the computer. I would rather train them to look at where the site is hosted, simpler than explaining everything about phishing. Which I have to explain using analogies of "Fishing" and "Baiting", let's just say it gets complicated for a person not well aware of internet to figure that out.

Re:Nostradamus Predicts

[jazman_777]

I can't come up with a good analogy to explain my point

(I'm responding to this comment _before_ reading any other replies.) Don't worry, the failed car analogies will come out the woodwork. See my sig.

Re:Nostradamus Predicts

[RangerRick98]

heh, funnily enough, I had come up with a car analogy, but it sucked, so I skipped it. ;)

Re:Nostradamus Predicts

[Anonymous Coward]

I believe there is also already a FireFox extension which makes it blatently clear the domain from which the page you are viewing came (in the form of 20 point, neon green text, from the install I saw ...)

Re:Nostradamus Predicts

[jbminn]

The stats returned by Netcraft on two sites I own/maintain are very misleading. Good information is good, but bad information is generally worse than no information, because it influences our decisions in artificial ways.

It reports the HTTP URI as 'Since Nov 1999' which is correct. However, it reports the HTTPS URI as 'New site', which is completely false. The HTTPS URI resolves to the same IP, and has the same domain ownership details as the HTTP URI. The *only* difference is in the protocol of the URI. Both are virtual hosts on the *same physical server*. In the click-thru for the explanation of the 'New Site' status, Netcraft states: (quoted from http://toolbar.netcraft.com/help/faq/index.html#ne wsite)

"New Site" means the site you are currently visiting has not been seen before by the Netcraft Web Server Survey. This indicates that the site is very new and should be considered less trustworthy than other sites. Since most phishing sites spring up overnight and disappear just as quickly, you should be extremely suspicious if you see this when visiting what you believe to be a trustworthy site.

This is so misleading as to be silly. I believe you should be suspicious of Netcraft's analysis.

It would be interesting to hear Netcraft's explanation for this, as it seems to be an incredibly fundamental mistake in the implementation of their site assessment tool.

Re:Nostradamus Predicts

[theshowmecanuck]

I agree. I find the idea of people on Slashdot complaining that users do not educate themselves kind of interesting... considering the recent Slashdot poll on Dec 28: "When do you read the instructions?"

Basically around half the respondants said they do not read the instructions, or only pay cursory attention to them if they do (i.e. they may read the quickstart guide, or not even that... unless something blows up). If only half of the supposedly educated people on Slashdot read the instructions, why should we be surprised (or even disappointed) that normal users, with usually far less technical expertise, do not.

Re:Nostradamus Predicts

[Angostura]

That sounds very compelling, until you realize that Joe User knows that not maintaining his car will result in a fatality, whereas not maintaining the computer will most likely result in some slightly bizarre behaviour which will annoy them enough to gripe occasional about it - but not sufficiently to modify their behaviour.

Re:Nostradamus Predicts

[JoloK]

What a ridiculous quiz! Since none of those organizations would ever send me an email that I considered 'legitimate' (I don't do business with them), I chose 'No Answer' to all of them, and thus scored quite badly on the quiz. I still don't need no stinking toolbar ;)

Re:Nostradamus Predicts

[the_mad_poster]

That's irrelevant. The point of the post was that computers are complex machines requiring maintenance. The point was merely illustrated by poining out how silly it would be to ignore maintenance on another complex piece of machinery that requires it - an automobile.

It had nothing to do with the reasons as to why people choose not to maintain their systems.

Re:Nostradamus Predicts

[Archangel_Azazel]

--It's almost as if, at some point in their lives, people decided to stop thinking for themselves.--

I've noticed that it's about the same time as high school graduation....but that's just my viewpoint.

AA

Re:Nostradamus Predicts

[smart_ass]

What about the phishing vulnerability posted to secunia a while back?

See here:

http://secunia.com/multiple_browsers_window_inje ct ion_vulnerability_test/

As far as I can read, Firefox is still vulnerable.

Re:Nostradamus Predicts

[jonwil]

Why not make it so that it automatically blocks access to the sites.
i.e. anytime you access a known scam site (with a continually updated database where entries are checked to make sure they are scam sites), it will block access to it with a "cant access this site" message of some kind.
If you really want to access the site, there should be a way to do it but a way that is difficult to use (so that most newbies wont be able to find out how to use it) and it should have many warnings about why accessing a known scam site is a very very very bad idea.

Re:Nostradamus Predicts

[The Snowman]

The problem with this logic is that the phishing scams are so good, many "educated" users can't tell the difference. Take for instance the phishing scams that pop-up an image over the URL bar (with no borders) that makes the page look like http://www.citibank.com/ with a login page identical to the real thing. Of course, in the real URL bar, www.hackers-r-us.com shows up, but it's covered with the image of a legitimate URL. You can't expect users to be able to identify this, and you can't really call this user ignorance...

I think the old advice from phone solicitations still holds true -- never give out personal information in a conversation you did not initiate. If I get a call claiming to be from Discover Card, for example, I will never give out my information. I ask what the problem is and call them back to fix it.

If I get an email from Discover about my account, I go to my bookmark to their account login page, skipping the URL in the email just in case it is a phishing scam. If it is legitimate, the information on my account page will corroborate the email.

Re:Nostradamus Predicts

[The Snowman]

Don't come in here ruining the joke with your logic and insight. We just won't be having it.

I know sarcasm when I see it, however, I know there are a few elitist assholes on Slashdot (just like any community or organization, online or real world). I figured someone else would take it seriously, so I may as well take it seriously too but in a positive way.

Re:Nostradamus Predicts

[Unregistered]

I have a Ford. that means i don't need to change my oil on my own. I just get the shop to do it every 5K miles when i bring it in to get the engine fixed. Along with a new intake manifold, they changed the oil for me too!

Re:Nostradamus Predicts

[andreigh]

imho, they shouldn't make such a toolbar. actually, they shouldn't make stuff that protect the below-average user from making stupid stuff... if you're dumb enough to send 100$ to zimbabwe, then you will be the same in real life. it's called natural selection.

Re:Nostradamus Predicts

[Angostura]

Sadly, it isn't irrelevant. The point I was making was that people do an informal cost benefit analysis. They then notice that this complex piece of machinery needs complex frequent maintenance or... nothing much bad really happens. So they don't do it.

The stakes in car maintenance are more obviously high, thus making the comparison ill-judged at best and misleading at worst.

Re:Nostradamus Predicts

[RangerRick98]

Why not make it so that it automatically blocks access to the sites.

My point is this: Say the browser does have a feature where it accesses a known database of scam sites and blocks access. The user then gets used to the browser blocking access to scam sites and therefore doesn't have to think about whether a site is legitimate or not; the browser has always caught it before. Now say that either a site hasn't been entered in the database yet or, even worse, the database itself has been compromised. Now the user, trained to trust the browser completely, will blindly use scam sites that are no longer blocked and never realize it.

Sounds like

[Gr8Apes]

something you'd look at initially, get used to, and quickly ignore.

Reporting to the Business targeted

[jlrowe]

I wonder if Netcraft has a method to report to the targetted business (banks, Ebay, etc) so they can follow up on legal action.

Re:Reporting to the Business targeted

[sheppos]

There is a way to report to Netcraft in this, I would hope that these businesses might pay some attention to an email from Netcraft - they pay little enough when an end user reports a phishing site.

Confirmed..

[maskedbishounen]

Netcraft confirms it. Only /. readers are ever going to use this.

*ducks*

Re:Confirmed..

[Anonymous Coward]

Yes, because Slashdot readers are known for their love of Internet Explorer.

Re:Confirmed..

[mordors9]

And probably not even them. I do not use IE. I am perfectly ca[able of discerning a phishing email when I get one. Simply look at where the link is actually directed. If not ebay.com but some rather unofficial looking website, then guess what. I just delete it, or if I have the time, I do a whois on the domain and send a copy to the isp. I am not going to turn that process over to yet another tool bar.

Re:Confirmed..

[webview]

I typically won't even click on the link rather go to the site myself (by manually typing in the URL). For that matter, I rarely ever even need to do this. Most of the phishing emails I get are obvious or I don't even care about. These scams will (unfortunately) always work because there are enough ignorant people out there to take advantage of.

Confirmed!

[ValuJet]

Necraft has confirmed this toolbar exists.

For Firefox...

[excaliber19]

Not perfect by any means, but sure helps:

Firefox SpoofStick Extension

Re:For Firefox...

[allden]

Add whois functionality to spoofstick...

Re:For Firefox...

[Anonymous Coward]

say please..

Re:For Firefox...

[Ecio]

It's available for IE too http://www.corestreet.com/spoofstick/

Misreading

[bugbeak]

Am I the only one who misread this for "Microsoft releases anti-phishing bar"?

Re:Misreading

[Anonymous Coward]

Yes, you are. Learn to read.

Am I the only one who misread this for "Microsoft releases anti-phishing bar"?

Re:Misreading

[Zorilla]

Well, that would explain the reasons why people keep claiming BSD is dying.

is it that bad?

[Anonymous Coward]

have phishing scams become this big of a problem that we need a tool like this? I remeber back in the aol 2.5 days, you couldnt go more than 10 minutes without a mass phishing im trying to get your password. With secure sites and common sense, i believe most people can avoid phishing scams

Re:is it that bad?

[DaHat]

Ahh yes, the good old days... where AOL's primary response was to tack an ugly warning on each IM and e-mail window saying that "AOL will never ask you for your password or billing information."

Re:is it that bad?

[Spad]

But in the good old days there were only 6 people on the internet and they all knew what they were doing.

Now there are around 1 billion people online and the vast majority will click on anything that flashes and give anyone their personal information if it looks even vaguely legit.

Heh

[Eric(b0mb)Dennis]

Will this really protect people who succumb to phishing in the first place?

If you're going to fall for one of the oldest tricks in the book, I don't think this new-fangled anti-phishing toolbar is going to do you any help.

Re:Heh

[bje2]

i saw one of the worst phishing attempts ever a little while ago...you clicked on a URL that was supposed to take you on ebays site...however, the link actually went somewhere else...but, to cover up that fact, whatever program was running actually "painted" over the address URL on the screen...the problem was, even when you minimized the IE window, the address URL remained on the screen...ugh, it was a pathetic attempt...

Re:Heh

[Anonymous Coward]

Will this really protect people who succumb to phishing in the first place?

Nope, it won't. Phishing is more of a social engineering attack than anything else. You can get into a tit-for-tat technology battle against it, but the only solution is user education.

Until people realize that, like with cars, they must either learn to maintain home computers themselves or pay a professional to do so on a regular basis, the problems won't go away.

However, continuing the car analogy, the PC service industry still has a long way to go. It's horribly inconvenient for the typical user to get their computer serviced right now as compared to dropping their car off at Jiffy Lube every so often and getting a AAA card for 24/7 emergency service.

Phishing is a dying trend...

[Anonymous Coward]

Netcraft confirms it.

(ducks)

Netcraft confirms

[AtariAmarok]

It is official; Netcraft confirms: Phishing is dying.

One more crippling bombshell hit the already beleaguered phishing community when IDC confirmed that successful phishing attempts have dropped yet again, now down to less than a fraction of 1 percent of all phish-mails sent out. Coming on the heels of a recent Netcraft survey which plainly states that phishing has lost more market share, this news serves to reinforce what we've known all along. Phishing is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive scam list.

You don't need to be a Kreskin to predict phishing's future. The hand writing is on the wall: Phishing faces a bleak future. In fact there won't be any future at all for phishing because phishing is dying. Things are looking very bad for phishing. As many of us are already aware, phishing continues to lose market share. Red ink flows like a river of fish-blood.

CitiBank phishes are the most endangered of them all, having lost 93% of its core spam-relays. The sudden and unpleasant departures of long time phishmeisters developers Gordon "Bassmaster" Hubble and Frank "Fifth Third" Blackman only serve to underscore the point more clearly. There can no longer be any doubt: Phishing is dying.

Fact: Phishing is dying

Re:Netcraft confirms

[Anonymous Coward]

"It is official; Netcraft confirms: Phishing is dying."

The first thing I thought when I saw this topic. I'm only amazed by how long it took down the page before someone actually SAID it. =P

Re:Netcraft confirms

[mikep.maine]

Phishing emails may be dying, but identity theft is not. Identity theft has been moving to spyware, key loggers, and other types of phishing. Scammers are also attacking infrastructure systems like routers. Like all multi-million dollar businesses, it changes to accommodate its market and I would very much doubt that this is going to go away. Mike

Re:Netcraft confirms

[Brad1138]

Way less % is needed for spam to prosper. I don't see that as an indication of Phishing "dying".

Popup Blocker?

[hendridm]

I installed it at work yesterday because I like Netcraft and I only use the Google toolbar on IE to block popups (although I use Firefox 99% of the time anyway). I noticed it didn't block popups from the sites I visit (ex: cnn.com), even though it has the option to "block unrequested popup windows" in Options. The anti-phishing is great, but it would be nice if the popup blocking worked for those who can't install XP SP2.

I could care less since I use Firefox. My parents could use it since they have XP SP2. I guess the people who have to decide between blocked popups and blocking phishing sites are those who run 2000 or Windows 9x, although I think Earthlink has a toolbar that will block both (not sure how well it works though). Again, no big deal, but I thought it was strange that they didn't include a working popup blocker. Seems like a automatic throw-in for all modern IE toolbars, though anyone still using IE is likely either required to (through shoddy programming or "advanced" IE-only features (what I call "screw you" features, since they're basically saying that to anyone who doesn't run windows, is disabled, or uses a text reader of some sort (braille, cell phone)) or is too novice to understand why IE == death.

Anything but IE in 2005! Viva la revolución!

Re:Popup Blocker?

[DeathIsHere]

This is probably why pop ups are not being blocked:
This statment is from there privacy policy located at: http://toolbar.netcraft.com/privacypolicy.html

1 Information Automatically Logged

We use your IP address to help diagnose problems with our server and to administer our Web site. Your IP address may also used to display regional advertising banners.

and this is from the license agreement you need to agree too before installing:

8 Advertising and sponsorship

Part of the Toolbar may contain advertising and sponsorship. Advertisers and sponsors are responsible for ensuring that material submitted for inclusion on the Toolbar complies with relevant laws and codes. We will not be responsible for any error or inaccuracy in advertising and sponsorship material.

Re:Popup Blocker?

[Anonymous Coward]

I could care less

You mean you couldn't care less. Think about it.

Re:Popup Blocker?

[kevinx]

Hmmm.. who would those who can't install SP2 be? People who pirated the OS?

Re:Popup Blocker?

[Anonymous Coward]

No. I pirated XP and SP2 installed without any problems. :-D

Re:Popup Blocker?

[Karrots]

Or they could be those still running W2k.

Re:Popup Blocker?

[hatmouse]

Some customized applications break with SP2

Re:Popup Blocker?

[Anonymous Coward]

Owwwwwwwwwwwwww my head!

Re:Popup Blocker?

[FLEB]

Hint to PP: See entry under sarcasm.

Re:Popup Blocker?

[hendridm]

Hmmm.. who would those who can't install SP2 be? People who pirated the OS?

I can accept that you're a moron, but lots of people can't install XP SP2 who use IE. Have you ever heard of WIN-DOWS 2000? WIN-DOWS 98? EM-PLOY-ERS WORK-STA-TION? You might be interested to know that pirated versions CAN install SP2, and that not everyone runs Windows XP. BONG!

Re:Popup Blocker?

[kevinx]

man... it was supposed to be a joke but has gotten out of hand.

Re:Popup Blocker?

[JoloK]

Most things break with SP2; it's simply not a good idea to use it.

Re:Popup Blocker?

[Anonymous Coward]

Maybe some things break with SP2 (as with any major upgrade), but most work fine. No need for the FUD.

great tool

[shwouchk]

very nice tool for other uses besides phising prevention... hope it comes ti firefox soon, cause otherwise its useless for me...

no firefox support

[forgeeks]

It would be great if it worked in firefox. I won't use IE just to have this little toolbar.

Dave

I would think FF/ Mozilla users

[Nurseman]

are a little more tech savvy, on the whole. They have gone to the trouble to download a safer browser, and probably less likely to get sucked into a phish scam. OTOH, I have seen some pretty good ones, and I did click on a Pay Pal one, before I had second thoughts.

Re:I would think FF/ Mozilla users

[Errtu76]

except for the people who use Mozilla/FireFox because their friend/relative have advised it. Can you think of anyone that wasn't too technical whom you advised they should use an alternative to IE?

Btw, what's wrong with spoofstick?

Re:I would think FF/ Mozilla users

[DaHat]

So all of the parents and friends that Firefox fans that have been upgraded to Firefox by those who are afraid of IE and feel it is too insecure are tech savvy?

If that was the case... wouldn't they have upgraded themselves?

Yes, there are plenty of smart geeks using Firefox... as well as IE. There are also lots of not so bright people using Firefox... as well as IE (lets not get into #'s). Such a tool is still useful for those not too bright users, no matter what browser they use.

Re:I would think FF/ Mozilla users

[kryptkpr]

I've clicked one one before realzing it was a fake as well.. IIRC, it was something to the tune of www.paypaI.com

What really bugs me are those ones you get for "major american banks".. nevermind that I'm Canadian.

Re:I would think FF/ Mozilla users

[EoinOL]

You're probably right about Firefox users tending to be more savvy, on the whole - but there are still plenty of people who, for one reason or another, don't know a whole lot about computers in general and the internet in particular, yet still use Firefox.

As well as that, one of the aims of the Firefox community is to get as many people as possible using the browser. If we ever start seeing FF market share starting to approach that of IE's, then plenty of the new users will be people who will fall for a phishing scam - it's best to have at least some measure of protection for them ready and waiting. Relying on users having some degree of knowledge isn't really a proper substitute for having measures in place, especially if FF is aiming at the mainstream.

Re:I would think FF/ Mozilla users

[Anonymous Coward]

That's it. I'm boycotting Firefox. Once Joe Sixpack gets his hands on it, there will be all sorts of spyware and scumware specifically targeted at Firefox lusers.

I recommend Opera for those of us who must use an unpopular browser to save face.

Re:I would think FF/ Mozilla users

[Anonymous Coward]

Not to mention the ones who are using FireFox with the desktop icon changed to IE and labeled "the internets..."

Re:I would think FF/ Mozilla users

[thephotoman]

Why do you need spoofstick when Firefox itself gives you that information in the bottom right corner of the screen when you're on a secure site? And why are you putting up credit card numbers on non-secure sites?

Wrong way to fix the problem

[diegocgteleline.es]

IMHO the right fix is to have a good browser which don't allow phising.

Re:Wrong way to fix the problem

[Anonymous Coward]

you figure out a way to do that and let us know. PS its not possible

Re:Wrong way to fix the problem

[Anonymous Coward]

No, the correct way to do it is to turn phishing to everyones advantage via. natural selection. Let me explain; first of all ISP's need to create a sort of credit-clearing company for all internet users. This would not be credit in the normal sense, but instead a simple integer which indicates how "safe" a customer you are. The higher the integer, the safer you are. Those with low "credit" would be considered a risk as a user, much as it is now with real credit.

Now we just let the phishers and 419'ers go wild. Anyone who falls victim imediatly has their ISP account closed and they lose credit. Fall victim to two or three scams and your credit will now be so bad that any ISP in the entire world won't touch you, and you become a non-issue to the rest of the internet using public.

Eventually those who are too stupid to use the internet will be naturally selected out of the community, and only the strongest will survive. This should starve out phishers, 419'ers and other scammer preditors, resulting in an overall drop in scamming attempts. We all win!

Re:Wrong way to fix the problem

[stratjakt]

Phishing is really just a form of social engineering. It's old as hell too, people have been making cold calls claiming to be from the bank, mortgage co, etc.

Ob. Simpsons: "Whatcha do is, see, you give them all your credit card numbers... And if one of them is lucky, you win!"

The right way to fix it is to invent a new breed of human who can't be fooled.

Re:Wrong way to fix the problem

[RangerRick98]

Unfortunately, the ones least likely to succumb to phishing scams (read: /. readers) are also the ones least likely to breed. :)

Re:Wrong way to fix the problem

[Zocalo]

It's the wrong way of implementing the band-aid while we wait on 100% guaranteed Phish-proof browsers too. I mean, seriously, does this *need* a whole toolbar (that sounds like it needs to be visible to function), or would a single icon with an optional pop-up dialog when anything phishy (sorry) occurs suffice?

I mean, what's the idea here? Fill the screen with add-in toolbars so that you can't actually see the webpages? I've got five myself, but at least I know to switch off the ones I'm not using like Firefox's Web Developer toolbar extension until it's needed. Then again, I've seen people using Word with every single toolbar enabled and a tiny postcard sized view of their document which I assume they thought was better. Watching them hunting for specific buttons does tend to lend weight to the argument they are very wrong though.

Re:Wrong way to fix the problem

[Anonymous Coward]

Phishing is not a function of the browser, but a social engineering attack

Re:Wrong way to fix the problem

[abb3w]

PS its not possible

Not quite; it seems to first glance an AI-Complete problem, which class is currently unsolved, but not necessarily unsolvable.

I, for one, will welcome our new Phishing-preventing AI overlords....

Re:Wrong way to fix the problem

[Evil Grinn]

Phishing is really just a form of social engineering. It's old as hell too, people have been making cold calls claiming to be from the bank, mortgage co, etc.

Not to mention that we have the early threat of fake logon screens to thank for the fact that on NT and all later versions of Windows you must hit CTRL-ALT-DELETE before logging on. What's the difference between that and phishing, except for the introduction of websites into the picture?

Re:Wrong way to fix the problem

[Anonymous Coward]

Phishing is done via web pages. I recommend using a web browser that cannot render HTML unless it was served from a Guaranteed Trusted Web Site.

Microsoft Internet Explorer accomplishes this through its proprietary "zones" technology. Please configure your Internet Explorer to only display web pages from approved servers.

Re:Wrong way to fix the problem

[Vicsun]

Who modded this up? I want to sell him a bridge.

Re:Wrong way to fix the problem

[abb3w]

first of all ISP's need to create a sort of credit-clearing company for all internet users.

Zeroth, all ISPs need some way to uniquely identify each member of the populace. Social Security number isn't necessarily usable, as they lack statutory authority for access. OTOH, they could probably work out a deal for this to be a recorded factor for current commercial consumer credit records, as there's probably at least a one-way correlation between easy marks and people who are bad financial risks.

Re:Wrong way to fix the problem

[strider44]

have you ever used Lynx?

Re:Wrong way to fix the problem

[realdpk]

Blocking HTML mail at the server would be a good start.

Re:Wrong way to fix the problem

[CharlesF]

The fools! If only they'd implemented the evil bit!

Re:Wrong way to fix the problem

[FLEB]

Sure it is... just don't connect... to anything.

why not a function in firefox?

[Anonymous Coward]

either color the URL in RED with a warning mark when it does not match the real address or give a quick pop explaining this.

Re:why not a function in firefox?

[giantq]

If you use Gmail, they do this - you get a yellow bar or something at the top of the message when you get emails from phrequently phished websites saying it might be a fake.

Re:why not a function in firefox?

[generic-man]

How do we know what the "real address" is?

Re:why not a function in firefox?

[Anonymous Coward]

What happens when you are colour-blind? Making something in red is not going to help people like me.

Re:why not a function in firefox?

[Anonymous Coward]

the tag of course!! it's found a home!

Plugin?

[Anonymous Coward]

Why does that pesky windoze virus Win32.InternetExploer seem to have so many plugins for it?

Re:Plugin?

[conteXXt]

planned expandability?

Re:Plugin?

[Anonymous Coward]

MMMmmm lets see, your going to write a plugin for a browser, do you choose:

a) The one with 80% of market share
b) One with 10% market share

Your choice, but I will never work for a company run by you!

until they release the Firefox version

[hsmith]

i consider it still under release :o

but does it really matter? the people who would install it KNOW that they are scams. people like my mother, who would have no idea what the toolbar even means, would not

Re:until they release the Firefox version

[hsmith]

damn it i meant to say "under development"

Re:until they release the Firefox version

[Anonymous Coward]

It blocks the site so your mother can't get there, that's the point

Spoofstick

[BobMD]

Already available from Corestreet for Firefox and IE http://www.corestreet.com/spoofstick/

Re:Spoofstick

[thematrix5]

I have installed this one in FireFox and it works pretty good and is unobtrusive.

Great, just what I need . . . .

[deacon brown]

Yet another "toolbar" on my dad's computer. Half his IE window is already gone with toolbars, and little weather reporting and spyware killing doodads. It's a wonder the computer still runs. Then again . . .

Re:Cool

[Anonymous Coward]

www.google.com is the place to ask these things.

Oh and most decent printable CD's have a suggestion that works well on the packaging.

I'll give you a hint. Spray Shellac.

next time type www.google.com instead of www.slashdot.com

Yes I gave real info to a troll... but unless he has an iq above 120 he will never figure out how to sucessfully spray the disc.

Wait 48 hours

[SilverspurG]

And someone with a malicious website will have figured out how to use this anti-phishing toolbar as a vector for remote code execution.

Another (Promising?) Firefox Extension.

[sanityspeech]

Not that I am a phishing scam victim, but I look forward to using this application. FWIW, news reports are showing up about the increased intelligence of such scams. There was just one such report posted here yesterday.

Just because I have not suffered from such scams does not mean that I am invulnerable to them. Hopefully, this will be a very useful tool to combat the onslaught.

With any luck, this might be another Firefox killer app, in addition to googlebar. Maybe it could even deep-six the puny anti-spoof extension which is currently available for Firefox?

Adware?

[plover]

Not necessarily: did you read the EULA?

8 Advertising and sponsorship

Part of the Toolbar may contain advertising and sponsorship. Advertisers and sponsors are responsible for ensuring that material submitted for inclusion on the Toolbar complies with relevant laws and codes. We will not be responsible for any error or inaccuracy in advertising and sponsorship material.

So, be warned: it may contain some kind of adware, and it may be the kind you find hard to ignore. I'm not installing it until I know more.

Re:Adware?

[adeydas]

No no it will stop phising and start fishing customers for Viagra and Mortages.

Re:Adware?

[myukew]

excellent. could've been my idea! let's stop all the other phishers so we can phish more effectively!

That's what I call a good strategy

Re:Adware?

[drooling-dog]

Part of the Toolbar may contain advertising and sponsorship.

Ha! I suspected this as soon as I saw that it was coming out for IE first...

I already got an email about this one!

[AtariAmarok]

I already got an email about this one!

From: admin@netcrapht.com
To: slashdottroll@hawtmail.com
Date: 2004/12/28

Re: We've announcted a new anti-Phishing control bar for your browser! To take advantage of this amazing free offer, just login here and register using your name and Bank One check number! Don't delay. You will also be eligible for a free u-n-i-v-e-r-s-i-t-y diploma!

Re:Cool

[Anonymous Coward]

I've been hitting google.

Any search involving "inkjet" "cd" and "smudging" gives me 200 pages of e-tailers and advertisements.

Google is fast becoming nothing more than an advertising engine. Anyone else notice the sudden prevelance of commercial sites now that they've gone public? If I search for this slashdot headline verbatim, I betcha slashdot isn't the first result.

If you read my post you'd notice I already said spraying them with lacquer, but that's a pain in the ass.

BTW, only a moron would use shellac, it reacts with plastic and takes forever to dry.

It's Toolbar Mania!

[EvilStein]

MSN, Google, hi5.com, Netcraft, Yahoo, AOL's....

So guys, when will the Slashdot Toolbar come out? :)

Re:It's Toolbar Mania!

[Anonymous Coward]

So guys, when will the Slashdot Toolbar come out?

It's called Firefox + Slashdot RSS Feed + Live Bookmark on the toolbar ;)

Re:It's Toolbar Mania!

[Dr.Knackerator]

excellent. should include buttons for a) read article, then post message b) read other comments, then post message c) read nothing then post message d) auto generate humourous in russia/overlord/insensitive clod/1st post! posts of course button c would be the default

Re:It's Toolbar Mania!

[KontinMonet]

With all my toolbars, it's making it hard to read your posts. Could you please ensure everything fits onto one (or maybe two) lines at most please?

Re:It's Toolbar Mania!

[British]

Actually you might not have a bad idea.

How about have a toolbar that's tied to one site? So if you frequently search for movies, have an imdb.com toolbar(quickly look up movies you find playing on TV).

have a ???.com for searching bands. That'd be nice when I want to know a little bit more about a band I hear on a shoutcast stream.

Now the problem is finding any room on one's desktop with all these other bleepin' toolbars installed.

Re:It's Toolbar Mania!

[Garabito]

Imagine...

Not only shows the lasts headlines, but it also updates in realtime so you can have fp. It shows your karma, score of your posts and replies; that's if you want to give your info, you can also browse as AC with the tin foil hat mode.

If you are out of ideas for lame jokes like "in soviet russia" or "imagine a beowolf cluster", the random cliche generator will make on for you.

It has many color themes: regular, Apple, Games, Politics. It also has the IT color theme, but it's disabled by default to avoid damage to your eyes.

And of course, advertising from ThinkGeek.

Re:It's Toolbar Mania!

[Anonymous Coward]

I can't wait to click the "Cowboy Neal" button! It will make the polls so much easier. ;)

Re:It's Toolbar Mania!

[bbtom]

Personally, I'd quite like a toolbar featuring Natalie Portman putting hot grits in her pants.

Re:It's Toolbar Mania!

[resiak]

*cough*Keywords in Mozilla[ Firefox]*cough*

(For those who don't know, make a bookmark to the query page, replacing the query string with %s. Give the bookmark a keyword. Then typing keyword search terms into the address bar and hitting enter will replace %s with search terms before loading that bookmark. So I have an IMDB bookmark, with the keyword imdb and url string http://www.imdb.com/find?q=%s. No IMDB toolbar mallarkey for me!)

spyware

[paulius_g]

Spyware???

I hope not.

Re:Cool

[stratjakt]

You can't just open and close your posts with a relevant phrase, and fill the middle of your msg. with non-related helpdesk questions....

I can, and I did.

Did you know that in Halo 2, if you snipe the ghost right in that little round thing down by the riders foot, you can blow it up in one shot? And despite what people say, you can snipe people driving tanks, you just have to be above them to do it.

You can't just open and close your posts with a relevant phrase, and fill the middle of your msg. with non-related helpdesk questions....

I can and I did.

Re:Cool

[Anonymous Coward]

Get a clue, and post your questions on a relevant site, or thread.

And you, sir, should let the moderation system handle off-topic posts rather than adding more fuel to the fire. Ah shit, now I'm guilty of the same thing :-)

Netscraft confirms...

[Stevyn]

...that this is an old, outdated, and unfunny joke.

Re:Netscraft confirms...

[RangerRick98]

Ah, but until they confirm that it's dying, I'm afraid you'll have to keep reading it. :)

Re:Netscraft confirms...

[Geoffreyerffoeg]

Stevyn confirms...the Netcraft joke is dying.

Cross Site Scripting FAQ: Questions and Answers

[Anonymous Coward]

http://www.cgisecurity.com/articles/xss-faq.shtml

The browser?

[Mustang Matt]

The browser is for browsing web pages.

Windows only?

[Anonymous Coward]

What the heck?

Re:Cool

[Anonymous Coward]

you can and you did
and that makes you an idiot.

Re:What I do

[r3ddr]

I've read about it somewhere else

are you dudes starting to copy&paste others? (the register &co)

But it doesn't tell me

[Garabito]

What's the site running.

I mean, come on. That's obligatory for a toolbar from Netcraft.

Great for FP trolls!

[TrollBridge]

I can picture it already: "Next article posted in 3... 2... 1..."

Cool but...

[bahamat]

When can I get a Safari one?

Netcraft Confirms Phising is Dead!

[Anonymous Coward]

well, there ya go, the joke is in the subject

ah more toolbar hell...

[Anonymous Coward]

As if there wasn't enough screen space taken up already.

Switch to Firefox and enable the non-spoofing features and you don't need a toolbar (don't allow URL to be hidden, etc.)

In firefox, type in about:config
then set these to TRUE and never be "fooled" again:

recommended:
disable_window_open_feature.locati on
disable_window_open_feature.status
disable_wi ndow_open_feature.titlebar
disable_window_status_ change

optional:
disable_window_move_resize
disable_w indow_open_feature.close
disable_window_open_feat ure.directories
disable_window_open_feature.menub ar
disable_window_open_feature.minimizable
disab le_window_open_feature.personalbar
disable_window _open_feature.resizable
disable_window_open_featu re.scrollbars
disable_window_open_feature.toolbar

Re:ah more toolbar hell...

[Anonymous Coward]

The big one and one you should enable is disable_window_open_feature.location . Since people might not know what it means, it basically shows the current address of whatever webpage your visiting. A scammer could easily launch a popup with just input fields but without further investigation you have no idea which domain your at. With this one feature enabled every window will show the location bar and thereby domain name so you can be sure your dealing with the correct domain.
Personally I enable navigation tools and status bars in popups where possible. Why should I lose control over my browser?

Re:ah more toolbar hell...

[ZoomieDood]

How do I install these options on a global basis for all users on my computer? (I'm using the assumption that anything I add into the about:config window under my session only applies to me.)

Is there a global file I should look for or is this against the feature placed in personal preferences about randomized directory paths? (I'm using Mozilla, btw)

Won't work.

[tomstdenis]

Reason: Tools and overt actions are not solutions for stupid people.

Evidence: Warning labels on coffee.

Tom

Unconfirmed.

[Anonymous Coward]

Only /. readers are ever going to use this.

Not necessarily. I plan to look into this; if I deem it worthwhile and not overly intrusive, I may make it manatory for my users group, and recommend doing so to other departmental Sysapes at my job.

Not that I'll use it at work myself-- there's no version yet for the Macintoy OS browsers, and I only use a PC at home.

Not Gonna Help

[photonrider]

This toolbar isn't going to help. The user still has to know how to evaluate the information the toolbar is presenting. The information on it at Netcraft is going to require explaining to 99% of the users. It adds conplexity for users that already can't handle complexity. If it was a simple green light or red light then it might be useful for the masses, as is, it's more noise users can't handle.

Two simple things users should do that have already been published in nearly every article on scams;

1. Use an email client like mail in OSX that you can configure for text only with the option to load images. That alone will reveal scam emails for what they are instantly.

2. Never ever enter personal information on some web page you got off a link in an email. Never. If it purports to come from your bank, manually type in your banks URL and see if you can verify what the email is saying, or call your bank or credit card company. Banks or credit cards today will never send you an email trying to scare you, saying you'll "lose access" if you don't visit their site. They've already learned not to do that because of the scams.

This toolbar might be interesting to a geek but it will raise more questions from ma and grandma than it answers.

Re:Not Gonna Help

[Anonymous Coward]

Have you used it? - No!
Have you even read the docs? - No!

If you used it you would know it blocks known phishing urls. The other data it provides allows you to spot new ones.

Try:
Read - Think - Post
not
Post - Post - Post

Re:Not Gonna Help

[dbacher]

The way the toolbar is supposed to work (wish people would RTFA and read the page on Netcraft that goes into detail) is that people like ISP's use the information in the toolbar to identify phishing sites. That's people like you, like me, and like most of /. who know the phishing attempts are phishing attempts (and they are sophisticated these days). When a less experienced user tries to surf the site, if it is a confirmed phishing site, they get a Netcraft page explaining that it is a scam site instead. The way it works, again, is that experienced users such as ISPs, /. readers, etc. visit the phishing site and report it, then once Netcraft has sufficient data on the pattern a particular scam is using, they block it. This takes advantage of the fact that phishers have to send the message to a huge collection of people, and are hoping for one in ten thousand or one in one hundred thousand to actually believe the scam and click on it. Alot of users who know the site is a phishing scam will get the mail, and if they visit it and report it, then any user with the toolbar won't be able to visit it. The idea, which I think is sound, is that those of us who look at a Phish and go "OMG who would fall for that" can go and report the Phish, after which nobody else would be able to access it. The information presented is so that the ISP, you, me, whoever intentionally visits the page in order to report it, has enough information to verify that it really is a phishing attempt and that it isn't a legitimate site. I.E. maybe Earthlink actually does send a gramatically incorrect message with an out-of-the-ordinary URL one time in a billion asking for billing information, and maybe that one in a billion messages really does originate from a korean ISP through some fluke of nature or obscure business practices. You never know.

Or you could just use the status bar..

[MadAnthony02]

I know there are more complicated phishing scams using IE holes and the like to make the address of the site show in the address bar, but all the phishing emails I seem to get send you to either a different domain name or an unresolved IP address. It doesn't take much to move your mouse over the address, see that it goes to 123.456.789.101 and not www.ebay.com to figure out it's a spoof.

Or you could just realize that ebay, paypal, and your bank will not send you emails asking for personal info, and never click on links on such emails but rather go to the site directly.

but why do that when you can download another toolbar?

Re:Or you could just use the status bar..

[Spad]

There are still IE exploits that allow you to spoof the status bar - not to mention that a line of Javascript will also do it.

Re:Or you could just use the status bar..

[dbacher]

Actually, sites can (unfortunately) change the mouse over and status bar text in the "on hover" event on a link. There was a message above on how to change this setting in firefox.

Non-slashdot users and family tech support

[Jtheletter]

A lot of people seem to think this tool will be useless or unused by the unwashed masses, which holds a certain amount of truth. One argument being if you're dumb enough to fall for a phishing scam, you're probably not aware enough to know to protect yourself in the first place, or if you've already got firefox installed you're already savvy enough to not fall for them.

Speaking as my family tech support geek (which I think most of us on /. can relate to) I think this tool will be highly useful for people who know nothing about phishing scams as yet another barrier *I* will install for them.

While a year wouldn't be enough time to educate all my relatives and friends on the various and ever-changing intricacies of PC web security, it's very useful to be able to install an app and tell them 'Look, if this thing pops up a big red warning, do what it says so you don't get a virus!' I've switched over everyone in my family to Firefox, all they care about is that it works pretty much the same for their needs as IE did. The google toolbar to block popups, zone alaram to catch other nasties, autorunning spybot and a coolwebsearch sweeper - these are all programs that make their web use look savvy but they ultimately have very little knowledge about. Now that my mom has started using the internet to buy things, no doubt she'll eventually get a phishing scam at some point relating to eBay or Amazon, with this toolbar hopefully now I can just set it and forget it and not worry as much that she's going to give all her bank info to some fake eBay site.

Eudora already does part of this

[WidescreenFreak]

Eudora 6 has been doing something like this for a while. If you get any e-mail with a URL in it, hovering over it will show the actual, underlying HREF, no different that any browser will; however, it will give you a warning if the URL is not the same as the underlying HREF code.

Sadly, the biggest obstacles to any topic such as this are user ignorance, apathy, and lack of common sense. And these are three massive hurdles that need to be overcome, which no single tool bar can do. As many can attest, it's a bitch of a task to try to get the following kinds of people to actually think rationally:

Oh, look! I just got an e-mail. Hey! It has a link! Although I cannot explain why, I have such an incredible urge to click on the link even though I have never heard of the company and I really don't need a fake Rolex watch! Same thing with those bank with whom I never know that I had an account, but I obviously need to update my information.

Re:Eudora already does part of this

[Ezza]

Yes, and I'm surprised that the mozilla group didn't think of something like this first, though I'm sure we'll see it implemented shortly :)

Some more info (screenshots etc) on the Eudora system can be found at:
http://www.eudora.com/email/features/scamwatch.htm l

Its EULA

[Rick Zeman]

Toolbar User Terms

Please read carefully

These User Terms govern your relationship with Netcraft Ltd ("Netcraft, we, our or us") and your use of the Netcraft Toolbar (the "Toolbar"). These User Terms affect your rights and liabilities under the law. If you do not agree to these User Terms, please do not download or use the Toolbar.

THESE USER TERMS DO NOT AFFECT YOUR STATUTORY RIGHTS

1 Use of the Toolbar

The Toolbar is provided to you for your personal use subject to these User Terms. By using the Toolbar you agree to be bound by these User Terms.

The functionality of the Toolbar is provided by means of a user interface implemented as a toolbar on your computer and a central server managed by us.

2 Amendments

We may update these User Terms from time to time and any changes will be notified to you via a suitable announcement via the Toolbar. The changes will apply to the use of the Toolbar after we have given notice. If you do not wish to accept the new User Terms you should not continue to use the Toolbar. If you continue to use the Toolbar after the date on which the change comes into effect, your use of the Toolbar indicates your agreement to be bound by the new User Terms.

3 Licence

The Toolbar is protected by copyright, trade marks, database and other intellectual property rights. Subject to your acceptance of these User Terms, we grant you a non-exclusive, non-transferable and non-assignable licence to download, install and use the Toolbar for your own personal, non-commercial enjoyment either at home or work. You must obtain our permission in writing beforehand if you want to carry out any commercial activity which involves using the Toolbar or any software or information associated with, or derived from, it. If you would like to do this, contact us at toolbar@netcraft.com

You may not otherwise reproduce, modify, copy, distribute, reverse engineer or use for commercial purposes any of the software or content in the Toolbar without written permission from us. No additional licence is granted to you to use any trade mark of Netcraft or its affiliated companies including, without limitation, the trade mark "Netcraft".

4 Availability

Your access to the Toolbar may be occasionally interrupted or restricted to allow for repairs, maintenance or the introduction of new facilities or services. We will attempt to restore the service as soon as we reasonably can.

5 Excluded services

The provision of the Toolbar does not include the provision of computer or other necessary equipment or compatible software to download, install and use the Toolbar. To use the Toolbar you will require Internet connectivity and appropriate telecommunication links. We will not be liable for any telephone or other costs that you may incur.

6 Liability

Although we aim to offer you the best possible service, the functionality of the Toolbar relies on information collected from a number of sources and while we try to ensure that the Toolbar facilitates a safe use of the Internet, we cannot accept responsibility if this is not the case. We cannot guarantee that the Toolbar will be fault free and you must bear the risks associated with the use of the Internet.

We will not be responsible for any technical problems you may experience with the Toolbar. If we are informed of any inaccuracies in the functionality of the Toolbar we will attempt to correct the inaccuracies as soon as we reasonably can. We make no promise that the Toolbar will meet your requirements. In particular, we disclaim all liabilities in connection with the following:

incompatibility of the Toolbar with any of your equipment, software or telecommunications links

technical problems including errors or interruptions of the Toolbar

unsuitability, unreliability or inaccuracy of the Toolbar

inadequacy of the Toolbar to meet your requirements

We welcome comments or suggestions on h

Re:Its EULA

[laard]

I'll just have to trust the moderation that says its funny... like pretty much any other EULA I just scrolled down to the end without taking the time to actually read it :-P

Re:Its EULA

[Rick Zeman]

ll just have to trust the moderation that says its funny... like pretty much any other EULA I just scrolled down to the end without taking the time to actually read it :-P

Don't. That moderator couldn't see through the cloud of smoke put out by his crack pipe.

Ah, I see what the problem is

[aurelian]

The alert needs to say "pwned". Then they'll ph34r your skillz (or something) and try and get your local police force to raid your house.

Touching.

[Anonymous Coward]

And I mean that in a completely heterosexual way.

Old news

[UncleScrooge]

This was on Anandtech a few days ago. /. Bit redundant to post it now.

Re:Old news

[Anonymous Coward]

No it's not, since a hell of a lot more people read slashdot than anandtech.

You're underestimating the effort involved.

[sean.peters]

Most people would rather have someone else change the oil in their cars, even though it takes 10 minutes and half the money than professionals charge.

Hogwash.

• driving to the auto parts place to get oil, filters, etc - 20 minutes
• draining oil, removing filter, installing new filter, adding oil - 10 minutes for this step only if you do this for a living. At least 15 minutes for ordinary mortals.
• Driving halfway across the county to the only place that will take used oil for recycling - 45 minutes
• Washing the clothes that got dirty while working on car - 30 minutes (with the possibility of doing other things during wash/dry cycle)
• 45 minutes/$30 spent getting Jiffy Lube to do it, while I shop, read, etc... priceless

Yes, I changed my own oil for years. Now I have better things to do with my life. Change a few words around in this reasoning, and you'll understand why "most people" don't want to fool around with their computers.

Sean

Re:You're underestimating the effort involved.

[sootman]

One to add to your list--owning proper jackstands and wheel chocks. You're not supposed to do all this underneath the included wheel jack, y'know. I agree with the point the grandparent was trying to make but he picked a reeeeally bad example.

Re:You're underestimating the effort involved.

[Stonent1]

You forgot "dropping the plug in the oil pan and searching for it" and "pouring cat litter over the stains caused from dropping the hot oil filter"

Re:You're underestimating the effort involved.

[MightyMartian]

> You forgot "dropping the plug in the oil pan and searching for it" and "pouring cat litter over the
> stains caused from dropping the hot oil filter"

And your wife shouting "Harold, if I can't have the car for my bridge game tonight, you're going to be sleeping in a real doghouse."

An oil change for me costs about $22. I gladly pay so that it's some shop jock's pain in the ass, and not mine.

I do fix my own computers, of course, because the average computer store around where I live charges about $50 an hour, and the average "technician" is far less experienced and skilled than I am (as most computer stores nowadays are unwilling to pay for real technicians).

Re:You're underestimating the effort involved.

[drinkypoo]

I don't take my vehicle to jiffy lube because the guys working in those shops, usually with one exception, don't know shit and are likely to fuck up your vehicle. There is usually one guy who works for any given shop like that who knows anything about anything and he's never there.

True stories of Jiffy Lube include coolant being put in the fucking engine through the oil cap, oil in the automatic trans and trans fluid in the engine, and an unending series of untightened or uninstalled filler caps and drain plugs.

Going to Jiffy lube is like playing an anti-lottery. If you're lucky, you just don't get fucked over so bad that your car is destroyed. And, good luck getting them to own up to the fact that they have destroyed your vehicle.

Re:You're underestimating the effort involved.

[leongalt]

If that is really what it took for you to change your oil, then you should definitely have someone else do it for you. I'm certainly no mechanic, but I've been changing the oil in my vehicles myself for the last 10 years (the entire time I've had vehicles) and I don't seem to have nearly the time of it you do. 10 minutes tops, start to finish. Usually only my hands get very slightly dirty, so nothing to wash. Auto parts store will take the old oil, they are 3 minutes away from my house.

And the real plus? I've never been upsold or lied to by the "mechanic" changing my oil. I've never had additional repairs to my vehicles because of incompetence of the technician (over tighten drain plug, cracking pan). I know for certain what kind of oil went in and what condition it was coming out.

But hey, we are in in different circumstances, do what's right for you.

Re:You're underestimating the effort involved.

[Anonymous Coward]

And your wife shouting "Harold, if I can't have the car for my bridge game tonight, you're going to be sleeping in a real doghouse."

I'm not trying to troll; this rant is borne of genuine curiosity.

I've never understood why marriage turns a man into a pussy (the "doghouse" phenomenon, among others).

If your wife has a problem with you, why are you the one who has to go sleep on the couch? It's your damned bed too; if she doesn't want to be around you, she can take her whiny ass elsewhere.

Re:You're underestimating the effort involved.

[Thrakkerzog]

Hogwash:

• driving to the auto parts place to get oil, filters, etc - 20 minutes for the first visit, buy enough for 2 or 3 changes. Do it while you are already out, when you start nearing the next change.
• draining oil, removing filter, installing new filter, adding oil - 10 minutes is plenty. As long as you didn't go to the jiffy lube and have superman crank down the filter and oil plug, that is.
• Driving halfway across the county to the only place that will take used oil for recycling - I have to admit that let these accumulate in my garage for a while before I take them in. However, almost every gas station in Pennsylvania has to take them.
• Washing the clothes that got dirty while working on car - use a creeper and don't let the oil fall on you. It's quite easy to do without spilling any oil on yourself. At most, you might get some on your gloves.
• Saving $20 by spending 20 minutes doing it yourself -- Priceless.

Re:You're underestimating the effort involved.

[Total_Wimp]

Saving $20 by spending 20 minutes doing it yourself -- Priceless.

Uh, no, not "priceless". $20. Unless you've got some kind of rare $20 bill that was painted by a famous Italian artist or something.

Re:You're underestimating the effort involved.

[msim]

Evidently you've not been married or hung around people who have. ;-)

(yes theres a bit of sarcasm in there.)

Re:You're underestimating the effort involved.

[MadChicken]

Man, I'm much more puzzled why my wife would call me Harold...?

Re:You're underestimating the effort involved.

[IncohereD]

If your wife has a problem with you, why are you the one who has to go sleep on the couch? It's your damned bed too; if she doesn't want to be around you, she can take her whiny ass elsewhere.

There is a somewhat simple (although not entirely accurate) biological reason for some of this. Mainly, mens' hormones cycle every day, and we want to have sex pretty much all the time. Womens' cycle monthly, so they only really badly want to have sex for a few days each month.

Result? Men pretty much have to always be on their best behaviour to make sure they have a chance of impregnating women (not so coincidentally they're horniest when they're fertile). So women get to dictate certain things, or your genes don't propogate.

Of course, at the same time I've had ex's that after a while wanted me on a regular basis way more badly than I wanted them, which is why their exes. It's much more individual than that, but that's the general root cause.

Re:You're underestimating the effort involved.

[Anonymous Coward]

Result? Men pretty much have to always be on their best behaviour to make sure they have a chance of impregnating women.

So men have to become pussies to get pussy. Feminism sucks. What ever happened to "I'll bring home the bacon, you supply the poon?"

Re:What I do

[lack1uster]

Jesus you're a fucking idiot.

I don't think so.

[Anonymous Coward]

IE == death

Really? I used IE until Mozilla (the suite) 0.9 came out. I assure you, I am still alive.

Re:I don't think so.

[Anonymous Coward]

Really? I used IE until Mozilla (the suite) 0.9 came out. I assure you, I am still alive.

They used to put cocaine in cough syrup too. Are you a coke head?

IE was good, but by today's "standards", it is crap. Ever heard of "standards"??

Are "Mozilla" and "Firefox" synonymous now?

[robson]

Currently the toolbar is only available for IE but a Firefox version is under development.

I'm just curious, are "Mozilla" and "Firefox" effectively synonymous now? Or do people sometimes mean Firefox but not Mozilla?

This is sure driving NetCraft's Ad Revenue...

[Christopher_G_Lewis]

OK, I'm a WinXP user, SP2, pop-ups turned completely off, run SpyBot, AdAware and look at my BHO's at least once a week because I don't trust computer programs, even though/because I write them for a living...

Installed it, read the instructions and FAQ (I know, I'm not supposed to do that :-), and have a couple of first impressions. I'm going to apply the "Mother Test" to the tool bar to evaluate it's usefullnes.

The tool bar installs with initally two items, Netcraft, and Services. Services is simply a drop down with links to all of Netcrafts services, trying to drum up business. I initally thought that services would hot link to some of the Netcraft tools like uptime and what is that site running, but no, just links to the main pages for them. There are 7 main items under serives, and 19 sub-items. Offerings
are impressive, but I don't think my mother would care at all about Hosting Providers or Web site auditing.

I can't evaluate the pop-up blocker since I have pop-ups completely turned off via XP SP2. I also run the Google toolbar, so pop-ups haven't bothered me in quite some time (except those occational ones that sneak through when you hold down the ctrl key to click a pop-up link. Who ever thought of using the same key to allow all pop-ups and allow one pop-up should be shot.)

As for the phishing, looks like it will work fine. The toolbar will have to pull down a new definitions file every couple of hours (2 by default), but that should be fine. Reporting a site is relatively easy. This is a thumbs up for the Mother Test

The Stats that it displays are pretty worthless. Pretty flags, but other than that, who cares. Rank is meaningless unless they get rid of their own sites. Pretty obvious that the most visited site is http://toolbar.netcraft.com.

The thing that most disturbs me are the stats that are gathered: http://toolbar.netcraft.com/stats/topsites
*Without*any*privacy*statement*, I have no idea what they are doing with my browsing information. This certainly scares me enough to uninstall this sucker. I understand that privacy is going away, I just like to fight it tooth and nail. (Except google, their cool. Until their IPO. oh wait... :-)

Oh yea. Regarding my subject: look at line 12 of the stats:
Rank Site First Seen Netblock Site Report Country
12 http://banners.netcraft.com June 2003 Netcraft Go UK

Re:This is sure driving NetCraft's Ad Revenue...

[Christopher_G_Lewis]

OK, reading the slashdot comments, I found this:
Privacy Policy. A little more comforting...

Also, check this out:
68 http://login.passport.net November 2002 Microsoft Corp Go US
69 http://slashdot.org November 1997 Savvis Go US

I guess this proves that Microsoft's passport is more popular then slashdot :-)

Don't bother downloading it

[litewoheat]

It doesn't play well with the Google toolbar. Hell it doesn't play well with any toolbars. After I installed it, all my (standard) toolbars were moved around or resized to 0 width. Its very frustrating when companies release crap software like this. Don't these people know about QA?

Doesn firefox already has a similar plugin?

[Asgorath]

Uhm wooptie, but doesn't Firefox already have a similar plugin with "SpoofStick"? Perhaps not as "advanced", but the idea seems to be the same.

https://addons.update.mozilla.org/extensions/mor ei nfo.php?application=firefox&version=1.0&os=Windows &category=Privacy%20and%20Security&numpg=10&id=121

Sad little IE users and all those toolbars with "free spywa... uhm, I mean software!" that they need to somewhat come close to Firefox :)

Worked around already..

[Anonymous Coward]

I installed it and tested it, by clicking on this fishing email I had recieved. Some website in Brazil.

When IE came up, the section of the Netcraft Toolbar that should have the information on the site was all white, except for an https link that pointed to ebay.com.

Probably just a glitch in the toolbar, but a little sad the first bad link I tried, it didn't help.

what we really need to worry about

[monotheist]

what we really need to worry about is all the telephone, power, internet, etc. companies serving up all your credit information to huge call centers filled with incompetent people over internet explorer. as my trainer says, "you'll have to open another E to get to that program." "that program" is the one we use to view and change account information.

it is scary, yes?
it is savvy, no.

Oh goody - another toolbar

[Linker3000]

A few more toolbars on the screen and I won't be able to see much more than a 1" strip of any suspect site anyway, let alone enter any information - cool! Secure!

Already trumped by phishing technology!

[wingspan]

Phishers are already rewriting the entire screen. They can rewrite the part that contains the Netcraft bar, also.

Also, does anyone know how the blacklisting works? Can an innocent firm be blacklisted until Netcraft gets around to unblacklisting them?

Damnit....

[CrackHappy]

I got so excited about this, until the last line about it only being available for IE. They better get cracking on the FireFox extension, as it would really boost FireFox as well.

Personally, I am just glad that they decided to do this out of the goodness of their hearts, and it's a great day for anti phishing folks out there.

Tip for possible Phish Scams

[Anonymous Coward]

Here's a tip I just read about 20 minutes ago in a company newsletter:

If you're unsure about the source (or if it came in an e-mail), enter a false password/id-password combo. If it really is your legit bank asking stuff, they will say 'incorrect login', if it's a scam, they will accept it because they're trying to steal it. Notify your bank's IT security office afterwards.

Solution

[Anonymous Coward]

I've already come up with my own toolbar. I can get it to you, just go to http://www.*.com, pull out your credit card...

Other Options - FraudEliminator

[steelrain]

FraudEliminator was released in November. While Netcraft's product resembles ours it does not provide the same level of protection. FraudEliminator was designed to protect our Mothers and Grandmothers. We not only block pages that are already on our black list; we analyze every page as it loads and block suspicious sites based on a user configurable set of rules. When a suspicious site is blocked you may choose to continue to the site if you know that it is safe or block the page from loading. We do not offer any advertising in our toolbar. We are close to releasing a Macintosh version as well as a Firefox version. We welcome all comments and suggestions. Jeffrey Hellman President FraudEliminator, LLC jnh@fraudeliminator.com

Browser space

[$exyNerdie]

If I use IE for another two years, my tool bars (pop-up blocking, anti-phishing, and what not) will take more room than the actual content of the web pages. Then browser page will effectively become a toolbar!

Toolbar Mania

[Daedala]

So I installed Trust, Google, Netcraft, Earthlink, Ebay and Spoofstick toolbars. This results in a) not enough screen space and b) Netcraft plotzing. Everyone else plays well, but the Netcraft toolbar disappears and gives errors like "An error (ActiveX component can't create object: 429) occurred while loading toolbar options. Please contact technical support for further information." All I wanted was a screenshot....

Toolbar?

[Genza]

Toolbar.

Too much info

[amigo7090]

I really do not care much about getting alerts for sites I just visit.
I want an alarm to sound only when it matters most - when I submit a form containing a password or a credit card number to a fraudulent site.
In my opinion that makes SignupShield or similar products a better choice.

Not another Adware enabled toolbar

[logicalchip]

Straight from the Netcraft Licence Agreement:

"Part of the Toolbar may contain advertising and sponsorship. Advertisers and sponsors are responsible for ensuring that material submitted for inclusion on the Toolbar complies with relevant laws and codes. We will not be responsible for any error or inaccuracy in advertising and sponsorship material."