Slashdot Mirror
Firefox 2.0 Wins Phishfight Against IE7
An anonymous reader writes "A new study that pitted the anti-phishing technology in Firefox 2.0 against that of IE7 generated some interesting results. From the Washingtonpost.com story: 'Firefox blocked 243 phishing sites that IE7 overlooked, while IE7 locked 117 sites that Firefox did not.' Microsoft responded by pointing to its own supposed comparison study that put it in front of Mozilla and others in phish fighting, but the story notes: '3Sharp, the company that authored the Microsoft study, clearly state on their site that their goal in creating 3Sharp was "to use the robustness, flexibility, and sheer native capabilities of the Microsoft communication and collaboration technologies to enhance the business of our customers."'"
that most phising sites are designed to circumvent Internet Explorer, since it is the most common internet browser, and practically the only browser for 'clueless' users, especially the ones that would be victims to a phishing site.
In a world of acronyms, the words are the real victims.
The risk of litigation inspired by false positives means they will always have to be a little more circumspect with who they classify as a phisher.
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
/slap Microsoft
* Anonymous Coward slaps Microsoft around a bit with a large trout.
I win, I win!
Firefox, or IE7?
Which way finds one
The phish-free heaven?
Let browser, like foam
Be lynx: sans leaven
Burma Shave
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
It's really Google vs. Microsoft because Firefox 2 essentially integrated Google's Safe Browsing extension into the core browser. And while Firefox has the ability to change phishing-list providers (Tools -> Options -> Security), the only one it ships with is from Google.
Get Firefox!
The author of the piece suggests a whitelist must be more practical.
Hmm , so that would mean checking against a list of a few billion web
pages as opposed to a few hundred for the scam pages. Anyone spot the
teensy problem? I do wish that just occasionally journos would have a
small amount of knowledge in the area they're writing about.
I didn't RTA, nor do I have OPera's 9.1TP installed with fraud protection, but I'd be interested in how it fares.
And I thought a Phishfight is what happens after you criticize Trey for falling off his trampoline during a 'smokin' rendition of 'You Enjoy Myself'
He who knows best knows how little he knows. - Thomas Jefferson
Its pretty hard to miss.
Here is the hard-coded example of a phishing site from firefox: its-a-trap!.
The info is here
liqbase
They come and go very quickly. Shutting something down legally is a tremendous hassle. You have to go to a judge and get a court order to do it. You have to find the ISP responsible for hosting it, assuming its in a jurisdiction you can get a hold of. You have to get the ISP to pay attention to you in the first place.
It's probably a few hours of work, and then 30 seconds later the same site appears elsewhere. Marking it as "phishing" in a database doesn't have any due process protections, but it's not as severe as shutting it down.
The clearly visible one would be better since there are people who are completely color-blind (i.e. see things only in shades of gray) or who are color-blind to certain colors.
A combination of what you suggest would be the most effective way of getting someones attention since it would be color-independent. Have the address bar flash between two different colored backgrounds which could be readily discerned to those who are color-blind yet understood by everyone else. How about red and yellow. They would show up to color-blind folks as dark gray and light gray.
Or, have an actual warning message appear and overwrite the page with a message about the page not being a real page and do you want to continue, then showing the real page if someone says yes, they want to proceed.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
...I've honestly ever seen the words "robust," and "Microsoft," in the same sentence.
The repeated crashes I had with FF2.0 all disappeared when I disabled the google toolbar add-in. With the integrated Google search, spellchecker and anti-phishing, there's very little for the google toolbar to do anyhow. Although, the buttons for finding/highlighting the search terms in the page are very useful.
...at least until they fix bug #356355 , which "jumps" the antiphising filter
fe, if you go to http://200.119.135.99/ebay/login5878/ the pishing filter will warn you
but if you encode the IP with a unusual encoding
http://0xc8.0x77.0x87.0x63/ebay/login5878/
the phising filter will not kick in
This seems to me like another bonus for Google and Microsoft in tracking users browsing habits. If every time someone visit a site using FF2.0 or IE7 it 'phones home' to find out of the page is a phishing site or not, won't these companies be able to build a more concise and accurate profile of web users? Just a thought...
I get spam but delete it without ever clicking.
I've learnt never to click links or open attachments in unsolicited mails.
liqbase
As the article points out, false positives were not addressed at all in this study. Without testing for false positives, those numbers are useless. If Firefox listed 100% of websites as phishing sites, the fact that it caught more than IE7 isn't all that impressive.
I get spam all the time... but I too had never seen this thing before. Just because people get spam and phishing emails doesn't mean they're dumb enough to click them. I don't even do it out of curiosity.
I teach a college course for teaching majors. Each year I do a phishing demonstration where I post a bunch of links on my blog, including one to the university's intranet. The links are all full paths (http://...), but the href in the intranet link points to a different server. When the students try to login, they get a message about phishing.
This semester I was a bit worried because I had heard IE 7 had new "anti-phishing technology." I thought IE would obviously check the text of the link against the target address, but that didn't happen. FireFox 2 doesn't either.
How hard would it be to check the text of a link against a regex for urls, then, if it is a url, check that the target is the same?
I'd rather have someone respond than be modded up.
Really? Tell that to all the critics raving about Firefox, Amarok, and OpenOffice.org, among others. I don't have to list my satisfaction points with these products here because they'd only be repeats of what others have said. If you're curious, look up the testimonials. The devs of these projects are fighting fire with fire. They're releasing a technologically superior (arguable for OO.o, I know) product for free. What's not fiery about that?
As for gaming, plenty of us don't use Windows because we don't use our computers for gaming. There are plenty of fun games that are native to the Linux platform, but I rarely play them because my computer is for getting things done, not putting off the things that need to get done. I have a PS2 for games. For everything else, including the simpler install (Ubuntu install is 300x easier than Windows to install) and the simpler, more intuitive UI (I didn't much care for GNOME until I actually tried using it - It really rocks) Linux is more than sufficient, and has become the only OS on my desktop and the "98% of the time" OS on my dual-booted lappy.
But above all, use what works for you. If you don't like Linux, don't use it. But I will warn you: *nix is becoming more and more prevalent. Just this year, my school replaced all its public terminals with Sun workstations. You can complain about lack of support for games all you want, but you'll eventually be forced to use something other than Windows.
Microsoft maintains there on database of phishing sites and they are focused on reducing False Positives. It is still relativly new.
If a bank is falsely blocked by Firefox they will simply tell users to use IE.
If IE falsely blocks a bank site they would simply sue Microsoft.
Both browser still have a margin of error of 20-40%. While IE blocks some that FireFox misses, FireFox blocks some that IE misses. Firefox is doing better, but I wouldn't say they are winning yet.
Half of writing history is hiding the truth.