Slashdot Mirror
Why Phishing Works
h0neyp0t writes "Harvard and Berkeley have released a study that shows why phishing attacks work (pdf). When asked if a phishing site was legit or a spoof, 23% of users use only the content of the website to make the decision! The majority of users ignore the address and SSL indicators in the browser. Some users think that favicons and lock icons in HTML are more important indicators. The paper hints that the proposed IE7 security indicators and multi-colored address bar will also suffer a similar fate. This study is brought to you by the people who developed the security skins Firefox extension."
Phishing works because people don't understand (nor do they want to) the basics of the technology they use (example: Jerry Taylor).
This guy's the limit!
It works because it plays on the concept that seeing is believing; and most people will trust their eyes over their minds any day of the week.
The world according to SComps
Humanity is doomed.
John
Think of the average internet user. I'm surprised that 77% are actually looking at more than just the content. It's probably because the media has made a big thing about it (as they should).
"There's a sucker born every minute." Listen, we can put an evil Devil's face on the browser, along with flashing neon lights and big signs that say "WARNING: This site is suspicious", and a gloved hand that comes out of the monitor and slaps the user silly, and you know what? People will still fall for these scams! It's not people like you and me that are the targets of phishing. Ask your grandmother what a URL is, and (with some exceptions, of course) you'll get a blank stare. Heck, ask the cute cocktail waitress at your local bar, and you'll get the same response (and I wonder why I can't get a date...). That's what we're up against.
Don't get me wrong, I applaud these researchers and all other approaches to making the web a safer place, but in the end, at some point you have to trust that the user is going to take resposibility for their actions. The best we can do is bring the percentages down. The problem is it is so cheap to set up a phishing web site, that even if only one in several thousand potential targets fall for it, that's usually enough to ensure a profit.
My guitar chord generator.
the phishers or the idiots who follow them.
When the suspect site, for arguement's sake let us say it was a credit card scam (since i had one of those a couple of days ago) asks for EVERYTHING--card #, PIN, security code, mother's maiden name, login name, and LOGIN PASSWORD, alarm bells should go off in your head. Also, it is highly unlikely that someone is going to give you a carrot on the end of a stick(in this case, $20 for a simple 3 question blurb about how the site was running or some bs like that) without a big catch involved. The obvious catch being that IT'S A SCAM.
Geez, i would feel sorry for these duped people, but it's getting harder and harder to.
To disrupt or completely stop this from happening is currently an impossible Herculean task.
Even netting one person can result in thousands of dollars worth of damages. If one in every one million phishing works, of course they'll keep doing it.
My work here is dung.
It works because a lot of people are idiots.
Including the ones who needed to do a study to figure that out.
For Anti-Phishing to work it needs a UI with support right down into the SSL layer.
Currently it's next to impossible to diferentiate things on the web. It's the great equalizer, and as we are finding, it makes things *too* equal. You are on equal footing with a bank when trying to convince people to enter finantial information. We need a bit more structure, a few more checks and balances.
set softtabstop=4 shiftwidth=4 expandtab nocp worlddomination
Con-artists are older than recorded time. Snake-oil salesmen, crooked used-car lots, (snail) mail scams and their ilk are likely at least as prevalent even in our quasi-"Information Age".
How many educated people have bought a lemon? I've known otherwise educated, extremely intelligent college-educated (students and grads alike) who've done this. Perhaps everyone should be fully educated about the hazards of auto-buying, phishing web-sites and maybe get a medical degree for proper evaluation of physicians while they're at it.
The answer is not pamphlets and FAQs. If anything these "easy answers" only propogate the problem of people being too damn trusting. Seek your own understanding.
/* MAGIC THEATRE
ENTRANCE NOT FOR EVERYBODY
MADMEN ONLY */
..and because most banks and such organizations still don't make any effort to authenticate their emails. That would go a long way towards making people more suspicious towards emails without a little key icon in the mailreader, asking them for their firstborn in exchange for continued onlinebanking availablity or such..
I don't get it, it's well inside major organization's capabilities to push for easily usable GPG or S/MIME support in email clients and webmail interfaces, yet they don't seem to be interested. Are they actually interested in having their customers spammed?
Your experience is not just a failure of attention to detail of the user.
It's a complete failure of the financial institution to realize they are creating situations where it is incredibly easy to teach bad habits.
They should not be sending emails with links in them at all. (Better yet, no emails not already contained in the online banking web site where the user is already logged in.)
So a HUGE portion of this problem is there _are_ legit emails that go out where there should be NONE.
It's a little like teaching your cute little 14 year old girl with the budding boobies that all guys really do love and respect them and are all christians and tell the truth especially if they are 40 or older and have their own van. Yeah it may be true most of the time but the concequences sure are high.
A little paranoia is a GOOD THING.
A bank expecting the average user to differentiate between good emails and bad emails is just stupid, stupid, stupid. They should KNOW better. There should be flat laws against it and the problem would go away overnight.
I think this is the funniest thing I have read in a long time. As a software developer for a largely computer illiterate user base, I have found that users try to get rid of dialog boxes as fast as possible, without ever reading the text. The longer the text (say over 8 words), the less likely they are to read it. Often they will always press 'yes' or always press 'no' until after a few tries they don't get the response they thought and try a different button.
I try to ask as few questions as possible. Users often don't want options, just action, and the ability to undo the action after it has happened.
It is dangerous to be right on a subject on which the established authorities are wrong. - Voltaire
In my experience, people will spend hours agonizing over little message boxes that have only an "OK" button. Seriously. People that won't read a Yes/No/Cancel will spend 15 minutes reading and re-reading the 7 words in the box that has only one option...
When I ask why, they always respond that they're not sure what to do.
When presented with a Yes/No/Cancel with 3 sentences in it, they just press enter without reading, because it's either too complicated or because it doesn't seem important. (It's just a popup box that asks a question I don't understand... but if I hit enter it goes away and I don't have to decide).
Incidentally, I partially blame all those InstallShield things that have the front screen with 3 paragraphs of text and a next button when there's really no meaningful information on the page, and nothing to do except click next to start installing the program (or cancel if you ran the installer by mistake)
From the UI side, however, I think that while OK boxes and Yes/No boxes are great, I think that OK/Cancel and Yes/No/Cancel boxes are heavily overused... If you want to ask a question where Yes/No isn't the answer, you should probably roll your own so that the buttons can be *descriptive*
What if people bought cars like they do computers?
General Motors doesn't have a "help line" for people who don't know how to drive, because people don't buy cars like they buy computers -- but imagine if they did . . .
HELPLINE: "General Motors Helpline, how can I help you?"
CUSTOMER: "I got in my car and closed the door, and nothing happened!"
HELPLINE: "Did you put the key in the ignition slot and turn it?"
CUSTOMER: "What's an ignition?"
HELPLINE: "It's a starter motor that draws current from your battery and turns over the engine."
CUSTOMER: "Ignition? Motor? Battery? Engine? How come I have to know all of these technical terms just to use my car?"
HELPLINE: "General Motors Helpline, how can I help you?"
CUSTOMER: "My car ran fine for a week, and now it won't go anywhere!"
HELPLINE: "Is the gas tank empty?"
CUSTOMER: "Huh? How do I know?"
HELPLINE: "There's a little guage on the front panel, with a needle, and markings from 'E' to 'F.' Where is the needle pointing?"
CUSTOMER: "It's pointing to 'E.' What does that mean?"
HELPLINE: "It means that you have to visit a gasoline vendor, and purchase some more gasoline. You can install it yourself, or pay the vendor to install it for you."
CUSTOMER: "What!? I paid $12,000 for this car! Now you tell me that I have to keep buying more components? I want a car that comes with everything built in!"
HELPLINE: "General Motors Helpline, how can I help you?"
CUSTOMER: "Your car sucks!"
HELPLINE: "What's wrong?"
CUSTOMER: "It crashed, that's what went wrong!"
HELPLINE: "What were you doing?"
CUSTOMER: "I wanted to run faster, so I pushed the accelerator pedal all the way to the floor. It worked for a while, and then it crashed -- and now it won't start!"
HELPLINE: "It's your responsibility if you misuse the product. What do you expect us to do about it?"
CUSTOMER: "I want you to send me one of the latest versions that doesn't crash anymore!"
HELPLINE: "General Motors Helpline, how can I help you?"
CUSTOMER: "Hi! I just bought my first car, and I chose your car because it has automatic transmission, cruise control, power steering, power brakes, and power door locks."
HELPLINE: "Thanks for buying our car. How can I help you?"
CUSTOMER: "How do I work it?"
HELPLINE: "Do you know how to drive?"
CUSTOMER: "Do I know how to what?"
HELPLINE: "Do you know how to drive?"
CUSTOMER: "I'm not a technical person! I just want to go places in my car!"
users HATE dialog boxes. I don't know whoever thought modal dialog boxes for everything where a bright idea.
The solution for that is to always make a "save" choice per default, and then allow the user to change the choice with a nonmodal, nonblocking dialog.
If the user does not want to change anything, no action is required.
Like in firefox
"this site requires additional addons, click here to install them" displayed on top of the page (and not in a dialog box).