PayPal Plans To Ban Unsafe Browsers

What If?... by Slashdot+Suxxors · 2008-04-17 14:15 · Score: 5, Insightful

Instead of having to force PayPal users to use only specific browsers, they educate the consumers on safe browsing habits and not blindly clicking on "OMG SEND ME UR CC NUMBER AND BANK DETAILS LOLOL".

Re:What If?... by Frankie70 · 2008-04-17 14:37 · Score: 4, Funny

Instead of having to force PayPal users to use only specific browsers, they educate the consumers on safe browsing habits and not blindly clicking on "OMG SEND ME UR CC NUMBER AND BANK DETAILS LOLOL".

Wow. That's a rather clever stragegy. I wonder why no one thought of it earlier.
I think they should just get all paypal users to assemble one day (may be in the Arizona
desert) and then teach all of them what you suggested.

Thinking more about it, maybe they should not just restrict themselves to Paypal users -
they should just assemble all internet users & teach them these things.
Re:What If?... by causality · 2008-04-17 14:42 · Score: 5, Insightful

Because whenever scammers come along to make stupidity more painful, we focus only on the fact that the scammers do this for their own short-term personal gain. Therefore, we lose sight of what happens to any community when all standards are lowered, no one is expected to think for themselves or make informed decisions, and causes (large number of clueless users) are confused with effects (criminals who take advantage of that cluelessness). It's easy for people who cannot separate their emotions from their intellect to get caught up in the outrage at parasitic people who profit from this situation and completely ignore why such scams are so successful in the first place.

Unprincipled people apparently need a fire under their ass before they will willingly broaden their knowledge, expand their experience or otherwise understand anything beyond the superficial level. To me that's quite a shame that they really seem to consider learning, an appreciation for self-reliance, and thinking for yourself to be terribly hard work to be avoided at all costs, rather than a journey of discovery that makes life much less routine and much more interesting. At any rate, if the goal is to remove all incentive to ever actually understand the tools (computers, networks, etc) that we use each day, we are on the right track.

As the saying goes, "A fool and his money are soon parted." Anyone who uses what he does not remotely understand and expects consistently good results qualifies as a fool. For some reason, when a computer is involved this commonsense concept is completely ignored.

Now cue the apologists and their thousand excuses for why literate individuals with no learning disabilities should not be expected to understand the basic concepts behind tools that they decided, of their own free will, to use on a daily basis. It's willful helplessness, plain and simple.

With the increasing social acceptability of this kind of victim mentality, the idea that you are responsible for your own well-being is apparently rather threatening to many people. This is obvious because they tend to give angry emotional responses instead of well-reasoned arguments explaining why they believe I am wrong.

--
It is a miracle that curiosity survives formal education. - Einstein
Re:What If?... by dmadzak · 2008-04-17 14:47 · Score: 1

What planet are you from? Do you really think phishing, spam, and viruses will be stopped with an education campaign?

Overall people are trusting and think that the bad things they read about will never happen to them. You can educate them up the wazoo, but you won't change their mindset.

Consumers view it as the company's job anyways to solve all of the above problems. If a consumer gets their information stolen they first blame the company instead of the phisher.

And finally the funny thing is by doing this, paypal will probably run the most effective campaign for security by forcing users to confront the issue. Of course they will just switch browsers and still will be easily scammed, but at least they were warned first.

--
Spelling and grammar mistakes specifically left in to give the grammar and spelling nazis a meaning to their life.
Re:What If?... by davidfromoz · 2008-04-17 14:49 · Score: 1

You mean all we have to do is stop users from clicking on deceptive links?

It sounds so simple, why didn't anybody do this before?

The fact is users have already proven they can't learn to avoid these scams. And its getting harder, not easier to avoid them. One day it might be me who falls below the geek intelligence threshold and becomes the victim. Hats off to Paypal!

Of course if they restrict my browser of choice, I'll have a choice to make. I'll either use a different browser or use another on line payment method.
Re:What If?... by TheSpoom · 2008-04-17 15:15 · Score: 1

Because PayPal's real reason for doing this is to extend the ways that they can keep you from withdrawing your money from your PayPal account, because they get more interest on it the longer it's in there.

This is why I'm very careful whenever someone wants to pay me a large amount via PayPal. I usually prefer a check or direct deposit.

--
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Re:What If?... by rtechie · 2008-04-17 15:20 · Score: 4, Insightful

People who fall for phishing scams are not stupid. They are often very smart people. Mere general intelligence is no defense against scams. Even being a scam artist or security expert yourself isn't a guarantee because NOBODY has encyclopedic knowledge of every scam in human history. If they run across a scam they're not familiar with they're just as vulnerable as "stupid" people.

Knowing how to use the tools offers no protection against scams. Knowing how to use a telephone does not protect you from callers that contact you and attempt to scam you. Knowing how to open a door does not protect you from people who come to your door and try and scam you.

You have a "blame the victim" mentality. It's clearly the fault of the stabbing victim that he got stabbed. He should have jumped out of the way. It's willful helplessness, plain and simple.

Scammers existed long before computers. If you created a free tool that would 100% stop all phishing under all circumstances the scammers would just switch to a different scam. The PROBLEM is the scammers. Period. Crime is the fault of criminals, not the victims.
Re:What If?... by csnydermvpsoft · 2008-04-17 15:23 · Score: 4, Funny

I think they should just get all paypal users to assemble one day (may be in the Arizona
desert) and then teach all of them what you suggested.

Send out a spam like this:

"I am the widow of a wealthy Arizonan entrepreneur. I am in need of assistance in transferring large sums ($153m) of money. Your help is appreciated. Meet me at the Tuscon desert state park at 8:00 in the evening on April the 19th to complete the transaction. I will give you 25% of the money as a reward for your assistance."

Also:

"Your PayPal account has been deactivated! To reactivate it, you must come to the Tuscon desert park at 8:00 PM on April 19. If you do not proceed, your account will be permanently closed!"

That should get all of the people in need of such education to show up.<g>
Re:What If?... by zappepcs · 2008-04-17 15:29 · Score: 1

I think of myself as a bit above average when it comes to computers and the Internet. I remember the first time I saw mosaic :)

In the early days of phishing, every now and then there would be a confusing but authentic looking email from one of my financial institution. Long after I started ignoring anything sent to ME from an institution, they stopped sending out stuff.

Now, if you are smart, ignore anything, log in and get your email messages from the system itself. Much safer that way. Yes, there is man in the middle, but much safer than clicking through someone else's proxy.

Even the intelligent can be confused or in a hurry and not paying too much attention.

--
Support NYCountryLawyer RIAA vs People
Re:What If?... by causality · 2008-04-17 15:31 · Score: 1

What planet are you from? Do you really think phishing, spam, and viruses will be stopped with an education campaign?

With an education campaign? No. A campaign is precisely the sort of one-to-many communication that presumes that your education (and therefore your well-being) is someone else's job. Did you not read my post? That needless dependence on someone else to look out for your own interests is exactly what I am against. It is the one thing that makes all the other problems possible, which is why the issue of whether PayPal should ban certain browsers based on features is a phony debate.

Overall people are trusting and think that the bad things they read about will never happen to them. You can educate them up the wazoo, but you won't change their mindset.

You're absolutely right. That's why I said "a fool and his money are soon parted." That's why I don't feel a shred of pity for people who refuse to take responsibility for their own experience and therefore end up getting screwed. Again, did you not read my post? If you did, I do not believe you understood it since you're exhibiting exactly the sort of knee-jerk reaction I hinted at. It's not like internet fraud is some obscure unheard-of subject. Some people (I would argue the smarter, wiser ones) can read about those bad things and learn from the mistakes of others. Other people (unfortunately this seems to be the majority) go on being too trusting and have to get screwed over before they decide that perhaps being such an easy target was a bad idea. Both scenarios are perfectly fine, since the individual involved has complete control over which one happens to them. Completely fine, that is, until folks with good intentions and no understanding of the Law of Unintended Consequences come along and tell the clueless that they are 100% pure victims and that what happened is not related in any way to their poor decision-making.

Consumers view it as the company's job anyways to solve all of the above problems. If a consumer gets their information stolen they first blame the company instead of the phisher.

Here, you are really just restating my point that people seem to think that their well-being (financial in this case) is someone else's responsibility. For as long as they believe this, they will continue to make poor choices and will continue to be naive, easy targets for these types of scams.

And finally the funny thing is by doing this, paypal will probably run the most effective campaign for security by forcing users to confront the issue. Of course they will just switch browsers and still will be easily scammed, but at least they were warned first.

With this statement you seem to agree with me that protecting people against their own stupidity is not within PayPal's power. In fact, no company has that power -- the best they can do is damage control and that's a far cry from prevention. Guess who does have that ability? That's right, the people themselves.

Indeed, this has a decent chance of creating a false sense of security. This is especially true when you consider that phishing is only one method used by scammers. Like I said, there are (many) people who have good intentions and a poor understand of the Law of Unintended Consequences ...

--
It is a miracle that curiosity survives formal education. - Einstein
Re:What If?... by Nefarious+Wheel · 2008-04-17 15:32 · Score: 1

For some reason, when a computer is involved this commonsense concept is completely ignored.
Disagree a little here. I don't believe a computer is necessary for common sense to be ignored, just an endocrine system.

--
Do not mock my vision of impractical footwear
Re:What If?... by Anonymous Coward · 2008-04-17 15:50 · Score: 5, Insightful

Grandparent is not equating being a victim with being stupid, but with being ignorant. Unfortunately in most cases, ignorant by choice. Notice he said "literate individuals with no leaning disabilities" should take responsibility for understanding what they are doing online. I imagine he, like me, would have more tolerance for the truly stupid who are literally incapable of doing any better.

If you understand the basic concepts of how the internet works and apply critical judgment in your transactions, you don't need to have encyclopedic knowledge of every scam in human history -- that's the whole point.

Grandparent also predicted that some would give "angry emotional responses instead of well-reasoned arguments." Nice job proving him right.
Re:What If?... by SiddGaur · 2008-04-17 16:00 · Score: 2, Insightful

Paypal is a great way for internet payments but if they make it more difficult for users I am not sure that they will be great anymore.
Re:What If?... by causality · 2008-04-17 16:06 · Score: 4, Insightful

People who fall for phishing scams are not stupid. They are often very smart people. Mere general intelligence is no defense against scams. Even being a scam artist or security expert yourself isn't a guarantee because NOBODY has encyclopedic knowledge of every scam in human history. If they run across a scam they're not familiar with they're just as vulnerable as "stupid" people.

There are many forms of stupidity. For some reason, intelligence keeps getting confused with wisdom. I'm honestly not sure if that confusion is deliberately encouraged in order to obscure the issue or if most people really have no working knowledge of what the difference is. They might both be true.

At any rate, you can have a very high IQ, perform wonderfully at all sorts of logic and mathematics problems, and still be a gullable easily-scammed individual if you refuse to accept that plenty of people do not operate in good faith. You can be very intelligent and still make very stupid decisions. You can be very smart without being humble enough to recognize your limitations and therefore to understand when you are operating outside of your areas of expertise. You can be very smart without understanding that your area of expertise consists of having memorized the ins and outs of a particular inventory of knowledge and that you lack the practical, working knowledge component of true understanding.

Knowing how to use the tools offers no protection against scams. Knowing how to use a telephone does not protect you from callers that contact you and attempt to scam you. Knowing how to open a door does not protect you from people who come to your door and try and scam you.

You are exactly right. Knowing how to use the telephone shows that you have memorized a small bit of intellectual knowledge. Understanding that there are dishonest people in the world and that therefore, not everyone who calls you is truly who they claim to be demonstrates a working knowledge of the world and of the limitations of the telephone network; that is, a bit of wisdom. So why the need to apologize for people who can't tell the difference? Why send the message that people who have to learn the hard way are victims and therefore are helpless and cannot do better next time at all? Do you believe that you are doing them any favors?

You have a "blame the victim" mentality. It's clearly the fault of the stabbing victim that he got stabbed. He should have jumped out of the way. It's willful helplessness, plain and simple.

Your analogy is flawed because once someone is stabbed, the laws of physics dictate that there is going to be a wound and it will probably be a serious one. It's not like a stabbing victim can decide "hmm, the point of a knife just struck my body with considerable force... should I let that injure me or not?" This is not the case with a scammer. Just because you receive a phishing attempt, there is no law of physics that forces you to give your personal information to a complete stranger without first performing some due diligence to verify that the stranger is who he/she claims to be. So while you might think you just made some profound point, you have compared an apple to an orange and have effectively made the claim that people must accept everything at face value and believe every lie someone tells them. Is that really your view of the world? Is it really your highest expectation of human capability? I celebrate your right to believe whatever you want, but I cannot support this type of victim mentality; indeed, it seems to be so ingrained into our culture that most people don't even recognize it for what it is.

--
It is a miracle that curiosity survives formal education. - Einstein
Re:What If?... by Spacejock · 2008-04-17 16:11 · Score: 1

The cash is tempting, but Arizona is a bit far for me. Have you thought about running regional meetings for the distance-challenged?

--
Hal Spacejock: Science Fiction with Nuts
Re:What If?... by jesser · 2008-04-17 16:12 · Score: 1

Knowing how to use the tools offers no protection against scams.

Part of knowing how to use a browser is knowing how to parse URLs. That's unfortunate, but I think it makes more sense to blame browser makers (and perhaps also users) than to blame criminals in this case.

--
The shareholder is always right.
Re:What If?... by complete+loony · 2008-04-17 16:20 · Score: 4, Interesting

Or you could embed the time and GPS coordinates into a seemingly harmless web comic and see what happens.

--
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Re:What If?... by kylehase · 2008-04-17 16:26 · Score: 1

If they (security experts) run across a scam they're not familiar with they're just as vulnerable as "stupid" people.
Knowing how to use the tools offers no protection against scams.
Understanding the underlaying technology makes a HUGE difference in susceptibility to phishing scams. If a user understands DNS, TCP, IP, NAT, routing, SSL, proxying, and WiFi, they'll have a much easier time identifying scams even if they're not familiar with that particular scam. Their eye's will be trained to look for typos or other dns tricks in the address bar. They'll check for SSL and validate certificate hierarchy for private transactions if they're not already confident about their certificate integrity for instance when using public terminals. They'll know not to use DNS servers assigned by DHCP in public areas.

You can't tell me that doesn't help. To fool the experts you'd probably have to circumvent the technology itself. If you gain control of a root DNS server or Internet router for instance. Or if you figure out a way to spoof a valid SSL certificate. Then again, if this becomes possible I'm sure it'll make huge news.

--
You want fun, go home and buy a monkey!
Re:What If?... by causality · 2008-04-17 17:24 · Score: 1

Grandparent is not equating being a victim with being stupid, but with being ignorant. Unfortunately in most cases, ignorant by choice. Notice he said "literate individuals with no leaning disabilities" should take responsibility for understanding what they are doing online. I imagine he, like me, would have more tolerance for the truly stupid who are literally incapable of doing any better.

If you understand the basic concepts of how the internet works and apply critical judgment in your transactions, you don't need to have encyclopedic knowledge of every scam in human history -- that's the whole point.

Thank you.

I believe you clarified that more eloquently than I would have. All I would add is that I am not making the claim that one cannot blame the scammers. You certainly can. It's just one of the most unproductive reactions you could have since you cannot control the scammer and are not responsible for what they do. The blame earned by a scammer is the scammer's problem; it will not make you a more difficult target.

Getting upset with the scammers while ignoring the economic incentives behind them (i.e. there are so many scams that they are obviously profitable) has not made them scarce. If fraud is profitable it's because we have not made it costly enough; if it is not costly enough it is because there is too much low-hanging fruit. If scammers exist it's because they are symptoms of something that has a root cause. It is not luck or chance or the way things happen to be. The root cause is not even ignorance alone, because that could be actively opposed. The cause of this is apathy, the kind of apathy and complacency that requires a wake-up call. For a lot of people, nothing else will do.

When someone maintains willful ignorance in the face of overwhelming evidence, readily available information, repeated warnings, and media attention ... when the best that they can come up with is "gee I hope that doesn't happen to me" and they are content to leave it at that ... then perhaps this is a situation seeking its own equilibrium.

--
It is a miracle that curiosity survives formal education. - Einstein
Re:What If?... by rocketPack · 2008-04-17 17:27 · Score: 1

Instead of having to force PayPal users to use only specific browsers, they educate the consumers on safe browsing habits and not blindly clicking on "OMG SEND ME UR CC NUMBER AND BANK DETAILS LOLOL". Hmm, just did a quick search of my Gmail inbox:
June 2007, from PayPal:
Subject: "Shop with PayPal for sizzling summer deals"
Prominently featured: "Take the Fight Phishing Challenge, Test your ability to spot fake PayPal emails."

May 2007, from PayPal:
Subject: "Now send money and make free calls"
#2 article: "Fight back against phishing"

February 2007, from PayPal:
Subject: Get a $15 cash rebate from PayPal
#2 article: "No Phishing Allowed. Fight back with our new Anti-Phishing Guide."

June 2005, from PayPal:
Subject: "Ten Ways to Spot Fake Emails" The entire email is about spotting/avoiding phishing attacks

Admittedly, they've been slacking off lately, but it's not like they've never tried it before. Also, a quick look at the PayPal Security Center reveals to me:
- Report fake (phishing) email
- Report fake (spoof) websites
- ...and a plethora of other tips and bits of useful information that any half-wit can find and understand

Honestly, I don't see how PayPal can be blamed for people's lack of willingness to self educate and be vigilant. It's your money, you need to protect it, don't rely on other people. They offer all the tools, it's up to people to take advantage of them and learn a thing or two.
Re:What If?... by Urkki · 2008-04-17 18:25 · Score: 1

Instead of having to force PayPal users to use only specific browsers, they educate the consumers on safe browsing habits and not blindly clicking on "OMG SEND ME UR CC NUMBER AND BANK DETAILS LOLOL". Am I the only one that thinks this sounds completely ridiculous idea? Educate the public to browse safely? Muahaha bwahahaa haha ha... You might as well try to educate them to fly by flapping arms.

And that comparison is completely valid. Flying by flapping arms is physically impossible (without some major genetic engineering and/or cybernetics), while people in general browsing safely in current Internet with current software is psychologically impossible (without major genetic engineering of humans to not be gullible fools).
Re:What If?... by Anonymous Coward · 2008-04-17 18:40 · Score: 1, Insightful

(Same Anonymous Coward again here.)

Agreed. Rtechie is right that we should never blame the victim, of course -- crime is truly always the fault of the criminal. When the criminal can be caught, he should be punished accordingly, and restitution made to the victim.

Yet, as rtechie also says, crime existed long before computers. It always has and always will exist and adapt itself to the technologies and circumstances du jour. No amount of law enforcement or technological advancement has ever or will ever fully eliminate it. We hope to put the burden on the criminal, but will never be 100% successful. There's no use pretending otherwise.

Therefore, the burden falls, however unjustly, on the potential victim to protect himself. It's an incomplete, imperfect and unfair solution, but there's no other way. You either bear the burden of protecting yourself, or you bear the burden of being a victim. Burying one's head in the sand or whining about the unfairness of it doesn't change this basic reality.

I certainly don't blame the victim, but realistically I have to recognize that the best hope of protection for oneself lies with oneself, and it's foolish not to take on a reasonable amount of care and responsibility for your own protection.

Well, this has been a lovely mutual admiration session, but it's now past my bed time -- right after I check that my doors are locked :)
Re:What If?... by Angostura · 2008-04-17 20:19 · Score: 1

You've never, ever been rickrolled have you?
Re:What If?... by Anonymous Coward · 2008-04-17 20:34 · Score: 0

Okay, that's one of the coolest things EVAR.
Re:What If?... by adrianmsmith · 2008-04-17 21:11 · Score: 1

Do you understand how your modern car works, with no user-servicable parts? It not, why do you drive it?
What about DVDs? Or do you just buy a machine, put the disk in, and expect it to work?
For that matter what about the optimization and pipelining your CPU is doing right now?
Too many complex things exist in our modern society to expect people to have even a basic understanding of everything. It is arrogant to assume that the aspect of it which you happen to understand is the most important, and people who do not have an understandng of it are fools.
Re:What If?... by Opportunist · 2008-04-17 23:18 · Score: 1

Just send a copy of your passport and your banking information, and we'll handle the rest for you.

Hey, customer service is our strong point!

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:What If?... by Opportunist · 2008-04-17 23:27 · Score: 1

Well worded and said. Where are my Mod points when I need them?

You can see that sentiment of "can't someone else do that?" a lot in these days. Especially when it comes to parenting. I mean, just search for the "thinkofthechildren" tag on here and you'll find a lot of stories where I, personally, start to wonder whether parents want to be anything more than cash machines for their kids anymore. Educating? Parenting? Teaching a set of standards? No, let the government, the schools, some lobbying groups handle that.

Taking responsibility ain't in fashion anymore. And personally, I find this tendency intimidating. We do willingly take the role of the permanent child. We accept that our "parents" (in the guise of government and other decision groups) decide for us what's good for us, and we're even comfortable with that. We don't want to grow up, it seems. We don't want to deal with problems. And most of all, we don't want to make decisions.

We want to live in a Disney-esque feelgood world. I can understand that craving for stability and ideal world when everything we hear on the news is terrorism, war, people going on killing sprees... But should we do without free will because of that?

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:What If?... by mikael_j · 2008-04-18 00:01 · Score: 1

Do you understand how your modern car works, with no user-servicable parts? It not, why do you drive it?
I don't own a car anymore but I do understand the theory behind combustion engines, fuel injection systems, how a gearbox works and most other essential parts of a car. Just like I can't rebuild my motherboard I still have a working knowledge of how it works even if the complexity of the system makes it impossible for me to know every detail.
What about DVDs? Or do you just buy a machine, put the disk in, and expect it to work?
Yes, before I stopped buying DVDs completely I did understand the basics of lossy compression and the Content Scrambling System.
For that matter what about the optimization and pipelining your CPU is doing right now?
No, but in High school I was, like all of my classmates, tasked with building various gates out of NAND gates, experimenting with registers and ALUs to replicate the basic functions of a CPU and many other electronics experiments. So once again, I have a knowledge of the basic theory even though I'm not designing CPUs at Intel or AMD.
Too many complex things exist in our modern society to expect people to have even a basic understanding of everything. It is arrogant to assume that the aspect of it which you happen to understand is the most important, and people who do not have an understandng of it are fools.
The problem is that lots of people have chosen, out of their own free will, to use computers on a daily basis yet they refuse to understand even the most basic computing concepts.

/Mikael

--
Greylisting is to SMTP as NAT is to IPv4
Re:What If?... by Anonymous Coward · 2008-04-18 01:14 · Score: 0

I think they should just get all paypal users to assemble one day (may be in the Arizona
desert) and then teach all of them what you suggested.

Send out a spam like this:

"I am the widow of a wealthy Arizonan entrepreneur. I am in need of assistance in transferring large sums ($153m) of money. Your help is appreciated. Meet me at the Tuscon desert state park at 8:00 in the evening on April the 19th to complete the transaction. I will give you 25% of the money as a reward for your assistance."

Also:

"Your PayPal account has been deactivated! To reactivate it, you must come to the Tuscon desert park at 8:00 PM on April 19. If you do not proceed, your account will be permanently closed!"

That should get all of the people in need of such education to show up.<g>

Also, all your monies will be deleted!!!1111oneone
Re:What If?... by Anonymous Coward · 2008-04-18 01:24 · Score: 0

Actually that's not a terrible idea. Send out a fake phishing scam and disable the accounts of anyone who falls for it. When they call to complain explain to them what happened and that they will occasionally be retested. If they fail 3 times disable their account permanently.
Re:What If?... by TheHorse13 · 2008-04-18 01:38 · Score: 1

What I find ironic is that Paypal wants to ban "unsafe" browsers yet they are the kings of unsafe/unethical banking practices. Gotta love treating the symptom rather than the cause.
Re:What If?... by DrXym · 2008-04-18 02:58 · Score: 1

There is plenty of education to stop users handing out passwords and personal details. Since people still do it, your plan is already doomed to fail. Some people are just too dumb, or too worried about the scary threats made in the fake email to take heed of warnings on the genuine site. And besides, they wouldn't see the genuine site so you could put the warning up in blinking 100pt font and it wouldn't help somebody visiting the spoof site.
Sometimes you just have to protect people for their own benefit. Forcing people to use a particular browser to sign up for a PayPal account is a good thing. There are also net benefits of forcing people to more recent browsers since it lowers exploits overall, improves the quality of web content, and reduces the profitability of spam. None of which are bad things.
Re:What If?... by Anonymous Coward · 2008-04-18 03:09 · Score: 0

Unprincipled people apparently need a fire under their ass before they will willingly broaden their knowledge, expand their experience or otherwise understand anything beyond the superficial level. Yeah Americans really suck.
Re:What If?... by Lemmy+Caution · 2008-04-18 04:52 · Score: 1

You can't count on changing consumer behavior. And the thing is, that it is not only the people with compromised accounts who suffer: people who accept payment from a stolen account may end up having their orders cancelled, etc.

Anti-phishing measures have become de rigueur for contemporary browsers. I think PayPal is right to exclude Safari.

And I'm a Safari user on Mac. It's good to have PayPal light a fire under Apple's ass.
Re:What If?... by Raenex · 2008-04-18 05:18 · Score: 1

Imagine you took your car in for a service check and mechanic says "part fnord is damaged, needs to be replaced, $100". Now maybe he damaged it when you took the car in -- subtly so that it doesn't produce symptoms that weren't there before, but such that if you leave it alone it will break in the future.

You may know in general how a car works, how to change your own oil, etc, but it's complex enough that you can't inspect the car 100% to prevent a dishonest mechanic screwing you over.

As a techie, it's easy for you to look down on those who don't understand the principles. Now I believe that there should be more emphasis on educating, but what it takes to be secure should be made as easy as possible. Only focusing on user ignorance is not the solution either.
Re:What If?... by SolemnLord · 2008-04-18 05:19 · Score: 1

Send out a spam like this: [snip]

I can't be the only one who wanted to read that to the tune of the Major-General's Song.

I am the widow of a wealthy Arizonan millionaire.
His will is complicated and I'm pulling out all of my hair.
Please meet me in the desert and help me sort out my affairs.
I promise not to kill you but instead will give you a nice share.

Etc., etc.

I'd be willing fall for scams that put the effort into being musicals.
Re:What If?... by bruno.fatia · 2008-04-18 06:07 · Score: 1

You know, there is an online bookstore I buy from that you choose a secret word (signature) and then a CAPTCHA-like image is generated and appended to all emails they send to you.
Re:What If?... by rtechie · 2008-04-18 08:16 · Score: 1

There are many forms of stupidity. For some reason, intelligence keeps getting confused with wisdom. I'm honestly not sure if that confusion is deliberately encouraged in order to obscure the issue or if most people really have no working knowledge of what the difference is. I'm confused by the way you use the term "wisdom" (which seems to be similar to "common sense"). Please give YOUR definition of "wisdom". How does one acquire "wisdom"? Are young children expected to have "wisdom"?
You can be very smart without understanding that your area of expertise consists of having memorized the ins and outs of a particular inventory of knowledge and that you lack the practical, working knowledge component of true understanding. This is gibberish. What you're trying to say is that it's possible to have a inventory of knowledge about a topic like medicine (for example) without knowing how to apply that knowledge in a practical manner (as a doctor would). I agree with this insight, but I do not understand how it is applicable to the current discussion. Very few people have a large inventory of abstract information about scams and no experience whatsoever in how those scams are applied. I'd argue the same is true of most computer experts as well.
Knowing how to use the telephone shows that you have memorized a small bit of intellectual knowledge. Understanding that there are dishonest people in the world and that therefore, not everyone who calls you is truly who they claim to be demonstrates a working knowledge of the world and of the limitations of the telephone network; that is, a bit of wisdom. So why the need to apologize for people who can't tell the difference? I can't tell the difference because you haven't defined your terms in any way.
Your analogy is flawed because once someone is stabbed, the laws of physics dictate that there is going to be a wound and it will probably be a serious one. It's not like a stabbing victim can decide "hmm, the point of a knife just struck my body with considerable force... should I let that injure me or not?" Are seriously going to argue that it's impossible for a human being to dodge out of the way of a knife thrust? I specifically used a knife in this example instead of a gun to drive this point home. Simply because it is POSSIBLE to avoid a crime does not mean someone is stupid or ignorant for not doing so.
Just because you receive a phishing attempt, there is no law of physics that forces you to give your personal information to a complete stranger without first performing some due diligence to verify that the stranger is who he/she claims to be. So while you might think you just made some profound point, you have compared an apple to an orange and have effectively made the claim that people must accept everything at face value and believe every lie someone tells them. I'll use a different analogy if it makes you feel better:

A person dressed as a police officer comes to your door saying he has a warrant and needs to search your house. You ask to view his credentials and warrant, both APPEAR to be authentic, but you're not an expert and really can't tell the difference between a real warrant and a fake one. You let the "police officer" in and it turns out he's secretly a serial killer and he shoots you in the head once he goes inside.

I think the above situation is very similar to phishing. You have a person disguised as an authority who makes demands on you. Yes, you could choose to ignore the police officer and refuse to let him inside, but you face the risk of being arrested. In a similar fashion, phishing scams often claim that something bad will happen (like your account being compromised) if you DON'T give your personal information.
Re:What If?... by shmlco · 2008-04-18 09:42 · Score: 1

"People who fall for phishing scams are not stupid."

How much intelligence does it take to never, ever assume an email or a call from a company asking for information or "verification" is actually from said company? Or to virus check your email? Add the old maxim, "if it's too good to be true, it probably is" to the mix, and you've eliminated 99% of the problem...

"The PROBLEM is the scammers. Period."

There's also such a thing as painting a bulls-eye on your chest and turning yourself into a target.

"Crime is the fault of criminals, not the victims."

And an ounce of prevention is worth a pound of cure. As long as we're throwing around old quotes. Take the appropriate steps, in advance, and you greatly mimimize your chances of being criminalized.

--
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
Re:What If?... by rtechie · 2008-04-18 11:35 · Score: 1

If you understand the basic concepts of how the internet works and apply critical judgment in your transactions, you don't need to have encyclopedic knowledge of every scam in human history -- that's the whole point. I strongly disagree with the notion that "understanding the basic concepts of how the internet works" will protect users from scams, including phishing scams, in any way whatsoever. Understanding the tricks phishers use (for example) generally involves understanding URL redirection and DNS spoofing which are advanced networking topics that even many experts do not understand. And as I said earlier, even if we magically eliminated phishing tomorrow, or educated every user in every imaginable aspect of phishing, the scammers would simply switch to a different scam that was less well understood.

Experience has taught me that that even computer experts get infected with viruses and troyjans, fall for scams, etc. If mere general computer knowledge was really an adequate defense against these scams this wouldn't happen. But in my experience this happens all the time.

And as I said earlier, the logic here is very strained. People who blame end users for computer scams NEVER apply this reasoning to any other types of scams or crimes. They somehow consider computer crimes to be completely different from other kinds of crimes, and that computer crimes do not require law enforcement.
Re:What If?... by rtechie · 2008-04-18 11:49 · Score: 1

How much intelligence does it take to never, ever assume an email or a call from a company asking for information or "verification" is actually from said company? If you truly hold this position you will have great difficulty using most remote services, like phone banking, mail order, etc. because this is effectively insisting on one-way communication with companies. What happens when (for example) you bank calls you to report a problem? That customer service person WILL ask you for personal information like your mother's maiden name, ZIP code, SSN, etc. to verify your identity. Using your method you would refuse to give that information and you would never learn (for example) that your credit card was stolen, or that an important payment bounced, etc.
There's also such a thing as painting a bulls-eye on your chest and turning yourself into a target. I don't consider (for example) using PayPal to be the equivalent of painting a bull's eye on your chest. Clicking on a link in an email is a NORMAL internet task.
Re:What If?... by causality · 2008-04-19 05:53 · Score: 1

I strongly disagree with the notion that "understanding the basic concepts of how the internet works" will protect users from scams, including phishing scams, in any way whatsoever. Understanding the tricks phishers use (for example) generally involves understanding URL redirection and DNS spoofing which are advanced networking topics that even many experts do not understand. And as I said earlier, even if we magically eliminated phishing tomorrow, or educated every user in every imaginable aspect of phishing, the scammers would simply switch to a different scam that was less well understood.

You're greatly complicating something that is actually very simple. I'll give one example, but this is a general principle.

If I receive an e-mail claiming to be from my bank which states that my account information has changed or that otherwise there is some input/information needed from me, I am not going to take it seriously nor am I going to click on any links in that e-mail or allow any Javascript/etc contained in it to execute. Instead, I'll separately launch my browser, go to the bank's Web site, and log into the account myself, with a URL that I type myself or a bookmark that I created myself. Then I'll check it out and see if there is anything that needs my attention. I would do this even if I have validated the links in the e-mail and am absolutely confident that it is not a phishing attempt.

Isn't that so much easier than maintaining, as the AC said, an encyclopedic knowledge of all Internet technologies and scamming techniques? While I do understand URL redirection and DNS spoofing, I don't need to understand those things to be an extremely difficult target. Your perspective on this issue seems to be a very narrow one; it might make sense if you insist on doing everything the hard way, but it does not take much creativity to realize that there are other options.

--
It is a miracle that curiosity survives formal education. - Einstein
Re:What If?... by shmlco · 2008-04-19 15:48 · Score: 1

" Clicking on a link in an email is a NORMAL internet task."

So much so that my bank and credit card company have both already told me in advance that they will NEVER send me an email asking for verification of account information. And the time my credit card number was stolen, they simply informed me of that fact and that they were sending out a new card.

The aforementioned rules have been working just fine for me so far, with no "difficulty" whatsoever.

--
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
Re:What If?... by Anonymous Coward · 2008-04-20 21:54 · Score: 0

Er, posting to remove accidental moderation... please ignore :o)
Re:What If?... by rtechie · 2008-04-21 11:16 · Score: 1

If I receive an e-mail claiming to be from my bank which states that my account information has changed or that otherwise there is some input/information needed from me, I am not going to take it seriously nor am I going to click on any links in that e-mail or allow any Javascript/etc contained in it to execute. ... While I do understand URL redirection and DNS spoofing ... Basically your advice boils down to "Never click a link in email, IM, or on many websites." I'm a security professional, and *I* do not do this. I think it's absurdly unreasonable.

Have you ever done professional tech support? Do you REALLY think it's reasonable or possible to get children or the elderly to do this? Or is your response "fuck old people"?

The "hard way", going after the criminals and punishing them, is the RIGHT way and the only way that will actually work.
Re:What If?... by rtechie · 2008-04-21 11:22 · Score: 1

Yet, as rtechie also says, crime existed long before computers. It always has and always will exist and adapt itself to the technologies and circumstances du jour. No amount of law enforcement or technological advancement has ever or will ever fully eliminate it. We hope to put the burden on the criminal, but will never be 100% successful. There's no use pretending otherwise. Nonsense. There used to be a thing in the USA called "banditry". If you went out into the countryside, roving gangs would rob you. This is near-nonexistent now. Lynch mobs are a thing of the past as well. Why? Because the police in various states banded together to hunt down bandits (so they couldn't just flee to another state) and the Feds cracked down on local police that encouraged lynching. So it certainly *IS* possible to eliminate or greatly reduce crimes if there is a strong enough incentive to do it. Youth gangs and youth violence have also plummeted too.

Again, just because it's not EASY, doesn't mean it's not the correct solution.
Re:What If?... by rtechie · 2008-04-21 11:52 · Score: 1

So much so that my bank and credit card company have both already told me in advance that they will NEVER send me an email asking for verification of account information. Are you SERIOUSLY saying that your credit card company called you, didn't even ask your name, and then told you "Bob Smith's credit card was stolen. We're sending a replacement. "? Was it automated?

You said previously that "no company" would "ever" send an email or PHONE CALL (emphasis mine) asking for any verification information whatsoever including Mother's maiden name, ZIP code, etc. As I can think of literally 100s of American companies that do this, including the phone and power companies, so I stand by my statement that you'd have a tough time getting by if you refused to do this.

I think that the fact your bank makes no attempt to verify your identity when emailing or calling you to be distressing and insecure (assuming that's actually true, which I seriously doubt).

I think these "I'm too smart to be tricked" claims I keep hearing from people are really amusing.
Re:What If?... by shmlco · 2008-04-23 06:31 · Score: 1

They called, asking to speak to me, then informed me that they thought my card number had been stolen, probably from a recent restaurant visit, and had I visited a massage parlor in San Francisco, ordered lobster in Austraila, and had drinks in Russia? Seriously.

I said no, and they said they'd cancel the number and ship a new card immediately to the address on file.

Further, any time I've contacted them, it's always the last four numbers of my SSN and a password I have on file. Anyone asking for the whole SSN simply isn't going to get it.

"I think these "I'm too smart to be tricked" claims I keep hearing from people are really amusing."

Actually, a few years ago (quite a few, actually) I had occassion to seriously study confidence games and scams and most have relatively obvious patterns. Money up front, "in good faith", "to hold your reservation", "for insurance", "in order to ship your prize", and so on, are clear beacons to anyone who'd give a half seconds thought to such things.

At any rate, I'll play by my rules, and you're free to play by yours...

--
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
Re:What If?... by rtechie · 2008-04-23 06:48 · Score: 1

They called, asking to speak to me, then informed me

Further, any time I've contacted them, it's always the last four numbers of my SSN and a password I have on file. So your original post was BS, as I've been saying.
Actually, a few years ago (quite a few, actually) I had occassion to seriously study confidence games and scams and most have relatively obvious patterns. Like I said earlier, I find this attitude really amusing. I can think of no way to make yourself more vulnerable to scams than to insist you're invulnerable.

Still vulnerable to phishing... by daeg · 2008-04-17 14:16 · Score: 5, Insightful

Dear PayPal User:

After much consideration, we've determined that your browser is safe again! Please log in at http://127.0.0.1/some/unsafe/address/.

PayPal apologizes deeply for the inconvenience.

Re:Still vulnerable to phishing... by BadAnalogyGuy · 2008-04-17 14:21 · Score: 5, Funny

Heh. That address resolves! 404, though.

But back up a bit and you get the whole directory structure. TONS of porn in a couple folders.
Re:Still vulnerable to phishing... by daeg · 2008-04-17 14:29 · Score: 2, Funny

Dear PayPal User:

Please go to http://www.whatismyip.org/ and copy and paste your IP address into a reply e-mail.

PayPal thanks you for your time and effort.
Re:Still vulnerable to phishing... by BadAnalogyGuy · 2008-04-17 14:40 · Score: 2, Funny

Somewhat related:
http://www.electric-escape.net/node/1475
http://www.thehumorarchives.com/joke/IRC_Idiot
Re:Still vulnerable to phishing... by LoadWB · 2008-04-17 14:42 · Score: 1

Or just send a reply email and we can dig it out of your headers.
Re:Still vulnerable to phishing... by Anonymous Coward · 2008-04-17 15:29 · Score: 2, Funny

Holy fuck that's MY computer. WTF guys, that's not cool. Ok so maybe I don't have my firewall PERFECTLY configured, but why would you make fun of me by showing all my porn on slashdot? Shit dude I'm totally freaked out. I don't know how to fix it I'm fucking unplugging everything for the night. Fuck.
Re:Still vulnerable to phishing... by Anonymous Coward · 2008-04-17 15:40 · Score: 0

Where? WHERE? I only see a couple thousand of .mp3s in mine. Life's not fair. :(
Re:Still vulnerable to phishing... by Anonymous Coward · 2008-04-17 15:50 · Score: 5, Funny

Heh. That address resolves! 404, though. But back up a bit and you get the whole directory structure. TONS of porn in a couple folders. Yeah, but it's stuff I already have.
Re:Still vulnerable to phishing... by RazzleDazzle · 2008-04-17 15:51 · Score: 1

Let's look at a random email I have here. OMG the end user IP is 10.1.0.50? let me paste that into nmap and see what ports you have open.
You can't always get end user public IP address if they are NAT'ed.

I think paypal should just quadruple their usage fees for those users instead of banning them, then get rid of the fees for the rest of us. If people are retarded enough to use a Mac (Safari) or other unsafe browser then they are probably easily persuaded to pay the additional fees for no reason other than they are not going to catch on.

j/k about Mac users being retarded. Well... not really. Hey if you cant take a joke you should probably stop reading slashdot as there are a lot of jokey jokemakers here.

--
ZERO ZERO ONE ZERO ONE ZERO ONE ONE! Just brushing up for my next big invention: Ethernet over Voice (EoV)
Re:Still vulnerable to phishing... by LoadWB · 2008-04-17 16:03 · Score: 1

So, in the end the end user's IP address from his or her email headers is as useless as the IP address given by whatismyip.com. My point was just one less step to confuse the potential victim, because then all you get is emails asking for help going to whatismyip?.com and you waste your time supporting rather than scamming.
Re:Still vulnerable to phishing... by RazzleDazzle · 2008-04-17 16:14 · Score: 1

The majority of them are useless, yes. The only really useful/accurate bit of header information is the IP address of the SMTP server connecting to your SMTP server which is the received line added by your SMTP server. Anything before that could be forged. Most legit email is generally going to have accurate info from anything more recent that the last RFC1918 address. But I was under the impression the majority of spam/scam emails used fake or forged from/reply addresses. In which case anyone replying would not really get their email delivered and could result in an undeliverable bounce message back to them. Email is just so fun of a beast to deal with.

--
ZERO ZERO ONE ZERO ONE ZERO ONE ONE! Just brushing up for my next big invention: Ethernet over Voice (EoV)
Re:Still vulnerable to phishing... by LoadWB · 2008-04-17 16:33 · Score: 1

Yeah, that is about right. For the most part your server's Received header is the most trustworthy. In fact, some automatic blocking systems which scan through the Received headers to extract lists of "bad" servers could be tricked into blocked legit servers by way of forged headers. Nasty affair. I am waiting until we see the advent of a header verification system which would use something like domain keys to validate Received headers.

Something along the line of

Received: from user (isp-user-dynamic-ip.isp.com [224.167.1.89])
by outbound.isp.com (8.14.1/8.14.1) key=BBehiuo18aXo with SMTP id...

or similar. A quick check of the TXT record for outbound.isp.com returns the complement key so the header validates.

Just a quick brain-fart.
Re:Still vulnerable to phishing... by LoadWB · 2008-04-17 16:51 · Score: 1

And to continue the brain fart, I completely missed that we should generate the header's "key" entry using a private key and some data in the header, like the SMTP id or similar ilk.

Ugh, more painful thinking.
Re:Still vulnerable to phishing... by vux984 · 2008-04-17 18:40 · Score: 1

Heh. That address resolves! 404, though. But back up a bit and you get the whole directory structure. TONS of porn in a couple folders. But its all stuff I've seen before. :(
Re:Still vulnerable to phishing... by Anonymous Coward · 2008-04-17 19:03 · Score: 0

Damn, you're right! It must be old stuff though, I've already seen most of it.
Re:Still vulnerable to phishing... by Anonymous Coward · 2008-04-17 22:46 · Score: 0

As a Republican member of Congress, I am shocked at the absolutely degrading filth available at that website and am currently drafting a law to sentence anyone who would download such smut to federal prison.

Now, if you'll excuse me, I need to, uh, gather more evidence for a congressional hearing.
Re:Still vulnerable to phishing... by Anonymous Coward · 2008-04-18 03:30 · Score: 0

Hey! How did you link to my Apache default page?
Re:Still vulnerable to phishing... by cappadocius · 2008-04-18 07:39 · Score: 1

An address at 127.0.0.1? That's just being mean.
I mean, how do you expect me to log in at that URL unless you first send me the code to run on my server? So rude.....

--
omnia tua castra sunt nobis
Re:Still vulnerable to phishing... by Jesus_666 · 2008-04-18 07:53 · Score: 1

Mac users aren't retarded, we're fashionably late. ;)

--
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)

Sounds about right. Root Cause Ignored. by twitter · 2008-04-17 14:19 · Score: 2, Insightful

I don't like to blame the victim but who clicks a link in an email? Really. Any site that makes it hard for me to get things done from their front page does not deserve my business, so I'll never follow the phish. The reason people still fall for this stuff is because copyright warriors and other IPtards make browsers and sites more complex than they need to be.

If Iceweasel and Konqueror are not on their "safe" list, I won't be able to use them even if I want to. Either the EWeek author or PayPal is clearly clueless because they used the words "safe" and "IE" in the same sentence, so their elimination of safe OS would not be a surprise. The world won't really be safe until insecure OS and the spam they generate are eliminated. Even then there will be a stuff that trickles through.

--

Friends don't help friends install M$ junk.

Benefits for Everyone Else by Ai+Olor-Wile · 2008-04-17 14:19 · Score: 2, Insightful

While probably rather nasty and nanny-statish of them to do so, I can't help but think that this will force at least some people using certain archaic standards-non-complaint browsers to use better ones, or at least heavily-patched copies of IE 6 (although, since Microsoft is big on IE 7, they might skip that entirely.) Who knows, it might improve standards compliance a little bit—at least as far as transparent PNGs are concerned. (Obviously, this does not count Safari.)

Re:Benefits for Everyone Else by Anonymous Coward · 2008-04-17 15:12 · Score: 0

Uh, even IE7 doesn't handle PNG's correctly. You can work around it with some Javascript but that's pretty lame.
Re:Benefits for Everyone Else by SanityInAnarchy · 2008-04-17 20:41 · Score: 1

Assuming it's a blacklist, and assuming it's based on actually vulnerable browsers, and not just browsers they don't like, then yes, I agree.

However, mentioning that they want people to use browsers with anti-phishing means they're likely never going to support the browser I use. So I will have to use some "approved" browser, once I've disabled the anti-phishing crap, of course.

In fact, the only way they could know if my browser supports anti-phishing is to use a whitelist, which means they're basically screwing third-party browsers. Which means you're going to improve IE-compliance a little, but I doubt it will do much for standards compliance.

Oh well. I'm going to wait and see. But if I'm nagged about my choice of browsers, I will stop using PayPal.

--
Don't thank God, thank a doctor!

Safe, Secure Internet? by Fluffeh · 2008-04-17 14:20 · Score: 1

Goodness me, that's just not right. The internet should partly stay a case of survival of the fittest. Gosh, in some way, it might be our next evolutionary platform to weed out the poor badly adjusted humans from propagating into the future? I can just see it now... (Angry womans voice) "What? You lost your bank account because you used a poor browser to access Paypal? That's the last straw! I am leaving you for another man - one that is more aware of internet security!"

--
Moved to http://soylentnews.org/. You are invited to join us too!

LOL. by gnutoo · 2008-04-17 14:21 · Score: -1, Flamebait

Would they really block Apple and GNU/Linux users as "unsafe"?

Re:LOL. by Anonymous Coward · 2008-04-17 14:23 · Score: 5, Funny

Rob Malda has barely made any effort to fully describe the process of selecting Slashdot moderators. What little information that has been supplied is an outright lie. The story of Malda's moderation system is far more insidious than merely separating wheat from chaff.
Last night, as I leaned over to give my Natalie Portman poster a tender kiss goodnight, I was psychically cast into a hypnotic trance. While entranced, my spirit guides delivered unto me the tale of the Slashdot moderators. Prepare to have your faith in Mr. Malda and moderation shaken to the core.
Difficult as it is to believe, Rob Malda was an outcast teenager. He did well in some of his classes, but was terrible with English. As is so often the tragic case today, his teachers passed him anyway, just to get rid of him. Since Malda had no real life, he spent much of his time on the computer (of course), and watching the public-access cable channel. It was there that Malda heard of the mysterious Mongolian Monks.
Malda was watching his favorite talk show, "Elizabeth Claire Prophet." The guests that night were a group of monks based in Mongolia. The monks described how they had been travelling to China to trade some of their cute teen daughters for Natalie Portman memorabilia. The monks had travelled no more than three days when they noticed a brilliant light in the daytime sky. The light grew larger. And larger. And larger. Soon the sky was completely hidden, from horizon to horizon, by a giant metallic disk.
The monks were taken aboard the craft and placed under some sort of alien mind-control. There, they were given the deepest possible insights into the nature of man, the universe and God. A week later, the alien beings returned the monks to the Earth and vanished forever.
The monks considered the area holy ground and constructed a new temple there, not bothering to return to their old monastery. They took their daughters as wives and began their own commune of worship, based on the teachings of the aliens. The monks practiced meditations which unleashed powerful spiritual forces within them. As the wives bore children, the community grew.
Malda was intrigued by the spiritual insights received by the monks and excited by the idea of incestuous pleasures. Unfortunately, the monks had no internet connection and so Malda could not email them. Without hesitation, Malda booked a flight and left for Mongolia. The plane ride was long and tiring, but his curiosity kept him driven.
After a month of searching, Malda finally located the commune. Initially, he, kept a safe distance, for fear of rejection. He studied the monks from afar. Malda had heard stories of the monks' bizarre meditations, which gave them extraordinary powers. Malda was somewhat skeptical of these stories at first, until he saw the truth first-hand.
In the week that Malda studied the monks, he witnessed the breaking of every natural law. He was astonished as he watched the monks levitate, create pockets of lush weather within the commune and communicated with spirit forces. Malda grew more and more excited and he devised a plan for meeting them.
Malda knew the monks would respect him if he could display his own "magical" powers. He was determined to win their confidence, and he had with him all of the necessary tools. He approached the commune confidently. The monks greeted him with skepticism at the gate. Malda took a deep breath and began his show.
Using an AIBO, a can of Jolt Cola and an inflatable sex doll, Malda shocked the monks with his display of magical powers. The monks accepted him into the commune. Malda's head was shaved and he was given a robe and a room. The monks warned Malda to stay away from their daughters-wives.
The monks methodically taught malda the word of the great messengers. He learned eagerly at first, but soon grew bored with his life in the commune. Malda's life was further stressed when his blow-up doll suffered a puncture-wound and became useless. A few days later, his AIBO's power dried up. With no pet and no woman, Malda slowly
Re:LOL. by piojo · 2008-04-17 14:44 · Score: 4, Funny

I have never before been so entertained by a troll/weird off-topic story. But I loved this line:
He took apart the AIBO and used its quality Sony components to enhance the machete with a nuclear driven flaming mechanism

--
A cat can't teach a dog to bark.
Re:LOL. by Anonymous Coward · 2008-04-17 15:00 · Score: -1, Offtopic

God that is so freaking cool!! I just want to know where you getting the sh*t you smokin... That must be some hardcore sh*t to give you this kind of visions.
God, the thing about the female wife-daughters living on a mongolian monastery created from a gospel sent by aliens, that is fragging coollio sh*t right there...
Re:LOL. by Anonymous Coward · 2008-04-17 15:01 · Score: -1, Offtopic

laugh();
laugh();
laugh();
laugh();
laugh();
laugh();
laugh();
laugh();
Hi there, Mark V. No Quack Ne Never mind.
this.mod(-1);
Re:LOL. by maglor_83 · 2008-04-17 15:04 · Score: -1, Offtopic

Sounds like a scientologist!
Re:LOL. by fluffman86 · 2008-04-17 15:18 · Score: 5, Interesting

Yes. Go to http://turbotax.intuit.com/freedom and pretend you want to file your taxes there. Understandably, you need to enable cookies/javascript. But then what happens? "Your browser is not up to date" it says. "Please install Firefox 1.07, IE 6, or Netscape 8 on Windows, or some other stuff for Mac."

Wow...please install these out-of-date or defunct browsers. So I contacted tech-support to let them know their page was broken, and they actually took the time to *link to the firefox 1.0.7* page, which says it's the most up-to-date version of firefox. When you click the download link, it takes you to mozilla.com where you can download firefox 2. *facepalm*

So after a bit of googling, I found the user agent for firefox 2 on windows (firefox 3's windows user agent *still* wouldn't work) and plugged that into the User Agent Switcher extension. TurboTax worked like a charm after that! All I had to do was lie and say that I was using Firefox 2 on windows instead of firefox 3 on ubuntu.
Re:LOL. by Anonymous Coward · 2008-04-17 15:20 · Score: -1, Offtopic

I love you.
Re:LOL. by Anonymous Coward · 2008-04-17 15:29 · Score: 1, Funny

That's the most delicious copypasta I've seen on /. in months, and yeah, I browse at -1 regularly.
MOAR!
Re:LOL. by Anonymous Coward · 2008-04-17 15:42 · Score: -1, Offtopic

Holy mother of fuck, if I had mod points, that's the funniest troll I've read in months.
We also knead moar folks upping the Scilon firehose submissions. We had the Scilons-vs-Wikileaks at "Red" for three days before Malda decided to ignore it. We had a journal entry talking about the "red rotting tomato" up to "orange", for Dobbs' sake. Let's not let that happen again. Suggested avenues of attack prone to /. firehose upvoting would include the link between Scilon Sonny Bono, the Copyright Term Extension Act of 1998, and the DMCA. Tie that in to the current campaign, and you've got win. (Yeah, May 10th is is Battletoads.)
But all that shit notwithstanding... whoever came up with that story, we want MOAR!
Re:LOL. by dhaines · 2008-04-17 15:47 · Score: 5, Funny

This Apple and Linux user blocks Paypal as unsafe.
Re:LOL. by Anonymous Coward · 2008-04-17 18:48 · Score: 5, Funny

I find your ideas intriguing and wish to subscribe to your newsletter.
Re:LOL. by Anonymous Coward · 2008-04-17 20:33 · Score: -1, Troll

for($i = 0; $i 50; $i++) {
laugh();
}
Re:LOL. by Anonymous Coward · 2008-04-17 22:13 · Score: 0

Firefox 3 (final) hasn't been released yet, I don't know why you would expect them to support a beta version.
Re:LOL. by Opportunist · 2008-04-17 23:16 · Score: 2, Funny

All I had to do was lie

It's a page that deals with doing your taxes. Duh.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:LOL. by antibryce · 2008-04-18 01:28 · Score: 2, Funny

THIS IS WHAT SCIENTOLOGISTS ACTUALLY BELIEVE

for those who missed it (and to avoid the lameness filter) that was a south park reference
Re:LOL. by Anonymous Coward · 2008-04-18 02:25 · Score: 1, Funny

For shame, you got marked as a troll for writing your comment in php. This should have been the proper response:

for (int i = 0; i < 50; i++) {
laugh();
}
Re:LOL. by gid · 2008-04-18 02:28 · Score: 1

I personally wouldn't expect them to support it, but I also wouldn't expect them to ban it.
Re:LOL. by Nemo's+Night+Sky · 2008-04-18 02:48 · Score: 1

I have never read something so beautiful. I just keep reading it over and over. We have to tell the world. Everyone, post this on digg. Email it to every person in your contacts. Call the radio stations. THE WORLD MUST BE TOLD!!!
Re:LOL. by Anonymous Coward · 2008-04-18 04:15 · Score: 0

Pusbag, is that you???
Re:LOL. by rrkap · 2008-04-18 04:21 · Score: 1

I can understand intuit (or any financial institution) not supporting a browser that isn't considered to be production software by its authors. The same thing happens to users of IE8. Besides, most people who are using beta versions of a browser have another, stable, browser installed.

--
I like my beverages with warning labels!
Re:LOL. by Anonymous Coward · 2008-04-18 04:41 · Score: 0

Why ban Safari?

It is the only truly 100% secure browser out there, being as immune to any attack as an air gap.
Re:LOL. by arjay-tea · 2008-04-18 06:03 · Score: 2, Funny

Looks like Rob Malda is not the only one who has no life.
Re:LOL. by cparker15 · 2008-04-18 09:39 · Score: 1

I filed my taxes through TurboTax for the Web using Firefox 2 on Ubuntu Gutsy without any problems. You get the warning, stating your browser isn't supported, and then you just continue anyway. It's just a disclaimer that, if you have issues with the site, they may not be able to provide technical support, as you're using an untested configuration.

--
Have you driven a fnord... lately?
You must wait a little bit before using this resource; please try again later.
Re:LOL. by ne0n · 2008-04-18 10:50 · Score: 1

You're spelling is remarckable. I wish mine was as good.

--
$ :(){ :|:& };:
Re:LOL. by Anonymous Coward · 2008-04-18 16:10 · Score: 0

You must think you're exceedingly clever. All your sockpuppets are going to karma hell, just like your twitter and Erris accounts. Just a matter of time.
Re:LOL. by dword · 2008-04-18 19:45 · Score: 1

I want to buy pot from you.
Re:LOL. by nobaloney · 2008-04-19 01:40 · Score: 1

Yes. All they care about is that the browser window changes color to show whether or not there's a Cert, and whether the Cert is Low Assurance (Domain Validated), Medium Assurance (electronic validation of domain and owner) or High Assurance (validated by humans taking multiple steps).

Which is reasonable (even though it may cost me business) because most people never even notice that most phishers don't even have certs.
Re:LOL. by Kalriath · 2008-04-19 11:06 · Score: 0, Offtopic

Just one note, if you define "High Assurance" as "Humans taking multiple steps" then all Verisign certificates are High Assurance, even the non-EV version.

At a previous employer, I was part of the process to get us a Verisign cert (the "cheap" version, not EV) and they required us to fax them a Certificate of Incorporation, look us up in a trusted company directory, call us on a number they got from the phone book (they would not trust our word on the number). Hell, the only thing missing was a DNA sample from the directors.

--
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".

Banks should do this. by sc0ob5 · 2008-04-17 14:24 · Score: 1

Banks should have been doing this since they introduced internet banking. Now the onus is on you and if you loose all your money because there was no requirement to use a safe browser it's your own fault. Seems like banks don't understand the concept of "users".

Re:Banks should do this. by Tackhead · 2008-04-17 14:31 · Score: 5, Insightful

Banks should have been doing this since they introduced internet banking.

Are you nuts?
"We're sorry. You're not using IE. And if you are using IE, your IE configuration isn't permitting us to run the MegabanX proprietary ActiveX control that our conslutants [sic] told us would eliminate all our liability. Please enable ActiveX support in order to continue banking with us, or turn off that Netscape thingy and upgrade to IE4.0 and resize your window to 800x600 while you're at it."
Forgive me for the sarcasm, but I had to switch banks twice because of that sort of crap. Think back a few years. The last thing any of us would have wanted "since they introduced internet banking" was our banks doing User-Agent and Javashit-based snooping on our configuration.
Re:Banks should do this. by Anonymous Coward · 2008-04-17 14:38 · Score: 0

The US treasury pulled that sort of thing a couple of years ago. Suddenly everybody that logs in has to type in their passwords via an onscreen keyboard that is randomized each time.

I haven't been able to access the account since, because they also insist on having archaic security in other areas which happens to be wrong. Vague information on how to remove the lock and leaving some people no way of getting in at all.

The banking industry while being hardly the most secure is far more reasonable about their security.
Re:Banks should do this. by Anonymous Coward · 2008-04-17 14:52 · Score: 0

1) We do not want this. The web should be based on standards, not Microsoft controlling everything.

2) Banks have FDIC insured accounts, unlike PayPal. PayPal likes to act like and pretend to be a bank. But it is not.

3) Raise your hands if PayPal has ever made it difficult to access your funds? I know my hand is raised.

4) Please do not PayPal or Microsoft decide what web browser you can use. Additionally, banks are not very good at understanding or making decisions about enduser tech. They should not decide this either.

5) In summary, the answer is standards. Just not the ones passed by the ISO. Seems the IETF is better at these things.
Re:Banks should do this. by fluffman86 · 2008-04-17 15:25 · Score: 1

My bank did the same thing...I complained and they finally fixed it after about 6 months. Luckily I lived so close to a branch, or I would have left. Almost did, but I can't complain now. :)

(except for the exact same TurboTax mess above) :P
Re:Banks should do this. by sc0ob5 · 2008-04-17 16:02 · Score: 1

I would have thought the last thing you would have wanted was for all your money to have gone from your account.
Obviously you are right in that it's not ideal for websites to query your configuration, but the fact remains that many people still use IE5/6 and don't run patched systems. These are the people that are likely to loose their money, these are the people that need protection from themselves. All the websites need to do is restrict access depending on which browser version and java version you are using. If you have an out of date browser or java version then you are directed to update. I am yet to come across a bank that uses activeX although I'm sure there are plenty of them.
Re:Banks should do this. by Anonymous Coward · 2008-04-17 16:08 · Score: 0

cough Suntrust /cough
Re:Banks should do this. by Anonymous Coward · 2008-04-18 07:24 · Score: 0

I could not agree more. There are sometimes valid reasons for blocking browsers (particularly fucking opera, which will cache passwords even when the website asks it not to). But the whole antiphishing toolbar thing is a complete joke.

I have seen false positives from both the IE and Firefox antiphishing toolbars, and given those were only for the bank I use, I wonder how many times it happens in general.

User Agent Change by macbuzz01 · 2008-04-17 14:26 · Score: 5, Interesting

Safari for Mac:

Preferences > Advanced > "Show Develop Menu in Menu Bar"

Develop > User Agent > Firefox 2.0.0.12

Suck it > Paypal

Re:User Agent Change by NeverVotedBush · 2008-04-17 14:40 · Score: 1

I never new about turning on the Develop menu!

Thanks, Macbuzz. It's done and done!
Re:User Agent Change by Anonymous Coward · 2008-04-17 15:09 · Score: -1, Troll

I never new about turning on the Develop menu!

Thanks, Macbuzz. It's done and done!

"I never knew about a feature that was right there from the beginning, that was not hidden, could be easily found with the slightest effort to peruse the settings, and is probably documented in several places!"

Perhaps you're exactly the sort of user that makes PayPal feel that they have to take such a shitty measure. Did you ever consider that?
Re:User Agent Change by Nullav · 2008-04-17 15:20 · Score: 2, Informative

And for Konqueror, it's 'Tools > Change browser identification'.

Really, I'd love to see someone knock PayPal out of the spotlight. For those of us without credit cards, it's usually the only option.

--
I just read Slashdot for the articles.
Re:User Agent Change by Anonymous Coward · 2008-04-17 15:27 · Score: 0

I never new about turning on the Develop menu!

Thanks, Macbuzz. It's done and done!

"I never knew about a feature that was right there from the beginning, that was not hidden, could be easily found with the slightest effort to peruse the settings, and is probably documented in several places!"

Perhaps you're exactly the sort of user that makes PayPal feel that they have to take such a shitty measure. Did you ever consider that?

Perhaps you're an obnoxious twit who doesn't realize the Develop menu was only added in Safari 3.1, which was released just under a month ago.
(there was a somewhat similar Debug menu in earlier versions, but it had to be enabled via the command line, not via a simple GUI preference)
Re:User Agent Change by Xyde · 2008-04-17 15:36 · Score: 1

Does anyone know what became of Safari 3's anti-phishing feature? It was there in the betas, I wonder why it was removed.
http://images.appleinsider.com/leopard-9A283-anti-phish.jpg
Re:User Agent Change by Anonymous Coward · 2008-04-17 19:49 · Score: 0

Yes and obviously anyone knowledgeable enough to change their user agent is probably not going to fall for a phishing scam, so in effect it will still help those that are really vulnerable.
Re:User Agent Change by Anonymous Coward · 2008-04-17 19:51 · Score: 0

So instead of using a secure browser, you just hide the fact that you're using an insecure one?

Bravo!
Re:User Agent Change by Anonymous Coward · 2008-04-17 22:38 · Score: 0

The people who this is aimed at are the sort of people who don't know enough to take care of security for themselves. If you don't know about secure browsing it is unlikely you will have enough nous to switch the user agent.

If, on the other hand, you are determined to give out your bank details to anyone and everyone without discrimination, then you get what is coming to you.
Re:User Agent Change by Anonymous Coward · 2008-04-17 23:31 · Score: 0

I bet they are expecting you to do this.

The sort of people that anti-phishing protection is useful for are generally not the ones that know what a user agent is.
Re:User Agent Change by Lincolnshire+Poacher · 2008-04-18 00:25 · Score: 1

> For those of us without credit cards, it's usually the only option.
Hurrah for alternatives that accept cash!
Click And Buy
Re:User Agent Change by NeverVotedBush · 2008-04-18 00:50 · Score: 1

Perhaps you're exactly the sort of user that makes PayPal feel that they have to take such a shitty measure.

I don't think so. I am very aware of phishing e-mails and never follow e-mail links. I never click on the paay using paypal on any web pages - I always manually go to paypal and then enter the payee information to complete the transaction, and I signed up for the one-time password generator so my account isn't just what I know access.

I have never had my account raided and luckily have never had my identity stolen.

I have also been watching the issues with Safari of recent and have been considering switching to FireFox on my Mac. I just haven't done it yet.

I won't say that I am immune from phishing attacks, but by manually navigating to paypal instead of following any web or e-mail-supplied links to paypal, I think I'm pretty safe.

But thanks for your concern.
Re:User Agent Change by Anonymous Coward · 2008-04-18 01:30 · Score: 0

For those of us without credit cards, it's usually the only option.
That's no excuse for using PayPal, since just about everyone can get a prepaid "credit" card.
Re:User Agent Change by NeverVotedBush · 2008-04-18 02:01 · Score: 1

OK, dweeb. I had been thinking about installing FireFox and just did it.

You can sleep easier. The world is now safe.
Re:User Agent Change by dmgxmichael · 2008-04-18 02:08 · Score: 1

Not so simple. They are looking for a feature's availability (EV SSL). They can verfiy the feature's presence by testing its functionality - if it isn't present then deny service. You could work around it by spoofing the submission form and while you're at it the referrer - but that's not so simple as a user agent change.

What they are doing is like requiring Ajax to use their site or not at all. You can defeat it, but it takes time and probably isn't worth it. From their point of view you can defeat their block because you "Know how the Internet works." Joe Average Internet User does not - he's the idiot falling for the scams and calling in, complaining, wanting his money back after the fact. He's the one who'll be forced to upgrade.
Re:User Agent Change by Anonymous Coward · 2008-04-18 07:43 · Score: 0

Compromised PayPal account because you insisted on using an insecure browser > Too bad for you
Re:User Agent Change by Nullav · 2008-04-18 08:08 · Score: 1

'Idiot-proofing' has nothing to do with browser security, just user education. There's no reason to cling to such a feature in the event that it isn't needed. This is merely another CYA measure by the sleazy bastards at PayPal and nothing more.

--
I just read Slashdot for the articles.

Well... by Renraku · 2008-04-17 14:30 · Score: 1

Not sure what to make of it at this point, but the gut feeling says this will be an excuse to be anticompetitive.

--
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?

Re:Well... by jt2377 · 2008-04-17 14:43 · Score: 0, Insightful

anti-competitive??? what's wrong with forcing user to use safer browser to access their private data. If nothing else, this move will force Safari to include the feature that can protect their users. What you are saying is cop enforcing safe belt is anti-competitive to car maker that doesn't include a safety belt and safety belt have saved more lives than without it. what kind of logic is that?
Re:Well... by Renraku · 2008-04-20 09:17 · Score: 1

Your example isn't a good one, but I'll provide a similar one.

Wal-Mart, trying to save on costs, gets rid of all their shopping carts. However, you can rent one outside from one of several different vendors. Suddenly, Wal-Mart decides to ban unsafe carts from the store.

Five of the six vendors are put on the unsafe list because they didn't pay the highest bribe.

This is going to become, "Pay us or we'll ban your browser."

I think it would start a very ungood trend among websites.

--
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?

Huh? by What+Would+NPH+Do · 2008-04-17 14:32 · Score: 1, Insightful

I guess I'm missing what's supposed to be so scandalous about this. I've seen plenty of government and financial institution websites do the same thing with blocking old versions of browsers or certain browsers they deem unsafe. Why is it that when Paypal does it that it's some big todo?

Re:Huh? by SanityInAnarchy · 2008-04-17 20:48 · Score: 1

Mostly because we expect it from governments and financial institutions. Remember, these are the sites that were required to support two-factor authentication, and instead, they now require you to type some five or so questions and answers about yourself -- you know, the kind that are usually used to help you, should you lose your password -- and require that you type one of those along with your password, and also look at a random "security picture".

Instead of, you know, handing out a physical security token, so it would actually be two-factor authentication. Or refusing to comply with the law, if it's really that expensive. But instead, they faked it halfway.

But every bank does it, so we're kind of jaded about it -- we expect it. Plus, no one of these banks has more people on their website than PayPal, I'd guess -- and eBay is now requiring PayPal. And there are those (like me) who use PayPal for additional security -- when I buy something, I am redirected back to PayPal's website, where I have to approve the purchase (with my PayPal username/password); much more secure than entering a credit card on anything HTTPS. That, and it's a tip jar...

In other words, they are big enough for it to hurt when they lock us out. There's the other thing -- I can just move to another bank if I don't like their website. There's not really much in the way of alternatives to PayPal.

--
Don't thank God, thank a doctor!

I have an idea... by Snowspinner · 2008-04-17 14:33 · Score: 5, Insightful

Why don't you trust me not to be an idiot instead of requiring that I use a different browser due to the fact that other users of my browser are idiots?

--
Philip Sandifer's academic website

Re:I have an idea... by Anonymous Coward · 2008-04-17 14:55 · Score: 0

But only an idiot would use PayPal.
Re:I have an idea... by Hal_Porter · 2008-04-17 18:27 · Score: 1

PayPal has its uses. If you have a site with freeware for people to download stick a PayPal donate button on it.

You won't make big money, but it will cover site hosting costs. Plus if you see some site you like you can donate to them.

--
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Re:I have an idea... by carou · 2008-04-17 20:59 · Score: 1

Worse than that! Why don't they trust me not to be an idiot instead of requiring that I use a different browser due to the fact that other users of other browsers are idiots?
Re:I have an idea... by Snowspinner · 2008-04-18 03:40 · Score: 1

There remain a non-trivial number of things for which PayPal is the only, or at least easiest way to pay.

I also ended up, for a while, using it as a de facto wire transfer between two accounts at different banks. Turned out to be faster than writing checks from one to the other.

--
Philip Sandifer's academic website
Re:I have an idea... by Lemmy+Caution · 2008-04-18 04:58 · Score: 1

Stolen accounts harm more than just the people who have their accounts stolen: they can be a serious inconvenience, or worse, to people who sell things to those accounts or recieve payments from them.

A reasonable attempt at harm reduction is, erm, reasonable.

(And on an unrelated note, in my struggle against a tide of ignorance, the preceding line is a case of begging the question.)
Re:I have an idea... by darkfire5252 · 2008-04-18 09:43 · Score: 1

Sounds great! PayPal should just ignore the needs of the majority of their user base and focus on the wants of the power users. Realistically though, you need to realize that the value of your PayPal account is diminished when people you do transactions with have to question whether or not you're the legitimate owner of the account or a casualty of phishing. What good is it if you are 100% safe with your computing habits, but everyone you try to by things from or sell things to has gotten phished, resulting in you losing money.
Re:I have an idea... by Snowspinner · 2008-04-19 11:35 · Score: 1

I don't think "not stupid enough to click a phishing scam in my e-mail" qualifies me as a power user.

My bank has a number of excellent protections against phishing scams. None of them involve blocking my choice of web browsers. I'm all for combatting phishing scams. But this is a moronic way to do it.

--
Philip Sandifer's academic website

Yes. by Mactrope · 2008-04-17 14:36 · Score: -1, Flamebait

Considering their basis for this decision is some kind of market data about fewer IE7 users abandoning their accounts, yes they would be dumb enough to block free browsers that run on more secure platforms than Windoze. The whole phishing problem is one created by M$ - it would not exist without the high percentage of compromised desktop machines that are sending out spam in the first place. IE7 is no more safe than it is standards compliant because the platform itself is easily, remotely compromised with keyloggers that report user information regardless of user activity. This whole thing is stupid.

--
http://slashdot.org/comments.pl?sid=216934&cid=17629948

Re:Yes. by LoadWB · 2008-04-17 14:41 · Score: 4, Insightful

Windows is not to blame for the phishing problem, PEOPLE are. Phishing has been around a lot longer than Windows and Internet Explorer, it was just a lot lower-tech and could not be perpetrated quite as fast.
Re:Yes. by Orion+Blastar · 2008-04-17 15:07 · Score: 4, Insightful

What next, users have to pass an IQ test to get on the Internet? That way all of the stupid people who click on email links from phishing scams before looking at the message to see if it is fake or not, will forever see "Error ID10T: User is not smart enough to use the Internet. Request denied!"

--
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
Re:Yes. by alex4u2nv · 2008-04-17 15:13 · Score: 3, Insightful

And the reason people purchase products from large companies is so that they could offload some of the "hassle" or responsibility to the company that is hiring qualified professionals to analyze and develop the product they wish to sell.

If me as a regular user (Pretend at the moment I'm not writing this from my linux laptop) wanted to trade my personal time to assume the responsibility of learning cutting edge counter phishing procedures, then I fail to see the purpose of paying for the service.

From the above statement, we could look at the underling problem here.
We as geeks know how to avoid these problems on the internet and whatnot, because it is our every day life. However don't expect a singer, entertainer, pilot, lawyer or mechanic.

If we could afford to, we will not change our own automobile's engine oil, even if we knew how to. So why should we expect mechanics, lawyers and any non geek to stay on top of CERT/Slashdot and all other form of security concerns when all they want to do is use it for basic communications and features?

Its the whole idea of specialization. People specialize in various trades, and sell services to each other.

In conclusion: When a regular user choose to pay $xxx.00 for a Windows license instead of learning how to install and use Linux for free. Its a time and hassle investment that they're making, and not really a religious preference.

--
-Alex. http://bit.ly/1iVPtfA
Re:Yes. by willyhill · 2008-04-17 15:21 · Score: 3, Informative

Anyone moderating this thread should be aware of the fact that twitter == Mactrope == gnutoo == Erris == inTheLoo. A little army of sockpuppets.
More information here and here.

--
The twitter monologues. Click on my homepage and be amazed.
Re:Yes. by LoadWB · 2008-04-17 15:22 · Score: 4, Insightful

Obviously IQ tests are not required to use the Internet, nor have children, nor drive, etc.
Re:Yes. by RobertM1968 · 2008-04-17 15:33 · Score: 1

Windows is not to blame for the phishing problem, PEOPLE are. Phishing has been around a lot longer than Windows and Internet Explorer, it was just a lot lower-tech and could not be perpetrated quite as fast.
I am really confused... let's see. Before Windows had "Internet Access" there was OS/2 which beat them out the door with it. Once Windows got Internet access (and before Internet Explorer), there was NetCom, various other dialups and AOL... NetCom and the dialups being one of the few that brought users onto the 'Net...
Then came Netscape (etc)...
...at which time, the Internet was so in it's infancy that phishing (by the definition on Wikipedia and elsewhere) did not exist or barely existed at all. There were less mechanisms for the more complex methods available today, and some mechanisms that existed both then and now (such as email) were in states that did not allow such things at that time.
Then MS bought Internet Explorer... then they eventually included it in Windows.
No matter how you look at it, Windows and Internet Explorer ARE the cause of phishing being as prevalent as it is.
One can blame it on the holes and lack of security in the platform or various versions of Internet Explorer...
Or one can blame it on the fact that it was due to Internet Explorer being integrated in Windows that the popularity of the Internet grew (of course, since Netscape owned the browser market at this time, that wouldnt be true)
Or one can blame it on the fact that the Internet is so popular because of a combination of PCs being so cheap and Windows dominance in the market (ie: mostly non-tech saavy users, who are the main cause of phishing problems/exploits).
Or one can blame it on a combination of 2 or more of the above (and others I havent mentioned) - but no matter how you look at it, phishing was not nearly the problem it is today (IF it even existed in anything we would even equate as the same thing in concept, or in definition).

--
StarTrekPhase2 - The Five Year Mission Continues!
Re:Yes. by LoadWB · 2008-04-17 15:45 · Score: 4, Insightful

And thusly, we purchase a service from PayPal MegaCorp and expect them to take measures it deems necessary to protect the service it provides. The bottom line is simple: this is PayPal's business, it is PayPal's right to choose how to operate it, and we can take our ball and go home. And considering how many people think PayPal is evil, anyway, this should come as a neither surprise nor disappointment.

But I still stand firm that people are to blame for the lack of security on the Internet. The telephone, the radio, the television, the tabloids, the newspapers, books, and so on were all considered at one time a method of mass disinformation, and some still are to a lesser extent. Why else would we have phrases in our lexicon like "you can't believe everything you read/see on TV/hear on the radio"? Because people are willing to throw caution to the wind. We are more apt to scrutinize and discriminate against information people may throw at us in person, face-to-face, but as soon as the information is put into some form of communication medium, we lose our senses.

We know the guy on the street corner in New York is not selling real Rolex watches; we know the fella that chats you up on the bus is not legitimately selling prescription medications. Even so, we are more apt to believe that these things are available on web sites, because we have it drilled into us that the world is at our finger tips, every thing can be found on the Internet.

If you want to get down to brass tacks and point fingers, WE are to blame for the folly of those who surround us. Yes, WE are to blame. Because WE chose to learn and understand and ignore the plight of those who have not. WE are the shop class instructors letting the uninformed use the table saw without proper instruction and then blaming them when they lose fingers. It is our responsibility to educate and inform others why what they are doing is wrong -- and in many cases we even get paid for doing so.

And I do not mean that using Windows is wrong, but that clicking on email links without thorough scrutiny -- or even at all -- is wrong; that blast-forwarding unconfirmed rumors is wrong; that not understanding that the bank will never send an email and tell you to go to a site and enter all of your vital statistics (and if it does, then you should run like hell, anyway.); that the use of semicolons is ill-advised.

I find it amusing that some of us will take the "duty" to throw out Mom and Dad's Windows PC and replace it with a Linux or Mac box, then walk away pleased with ourselves over the "service" we have just done. When, in fact, the "service" we should be providing is education. It does not matter in front of what box Mom and Dad sit, without the proper knowledge, they are still vulnerable to phishing schemes and exploits.

Really, these so-called idiots out there are mostly just uninformed. Some non-BOFH-type PFY handed them a computer at the WorstBuy, CompUSELESS, or Radio Shanty, without taking the short amount of time it takes to instill a small bit of cynicism over unsolicited or unexpected information and requests. There were no pamphlets at the store explaining how email can be as dangerous as a phone call from "your phone company" or "your bank." Most of these people CAN be taught and guided.

And the ones that cannot will be eliminated one way or another, but of course not before making complete and utter asses of themselves.
Re:Yes. by LoadWB · 2008-04-17 15:59 · Score: 1

I see your point, and I disagree with the basis of the argument.

Before any of what you mention there was the telephone, mail, fax machines, and more. Fraud schemes abounded long before phishing as we know it today, but the principles were the same: find some way to extract enough useful information from the mark. Phishing is the technological evolution of social engineering, and on a grand scale.

Additionally, in the past when scam spam was rampant, the thought of a botnet was just barely formulated. Such emails were blasted out via open relay mail servers, poorly programed web forms, free email services, off-shore hosting, and the like. I will not argue that the botnets have not made sending the emails exceptionally easy and avoiding them exceptionally difficult, not for a second, and will cede that without the botnets the flood would be a lot more shallow. I simply cannot subscribe to the notion that Windows botnets are completely to blame for Internet fraud.

Until I see reliable data which breaks down phishing victims based on operating system and browser, I reject the notion that any one group is responsible for the existence of the phishing problem. Except for the criminals who have mastered and continue to develop its attacks.
Re:Yes. by complete+loony · 2008-04-17 16:16 · Score: 5, Funny

And WE used to educate them every September. That is until AOL based their business on getting everyone to connect to the internet without bothering to properly educate them.

--
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Re:Yes. by Orion+Blastar · 2008-04-17 16:39 · Score: 1

Nor vote either or get a mortgage it seems. :)

--
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
Re:Yes. by Anonymous Coward · 2008-04-17 16:49 · Score: 2, Interesting

Its the whole idea of specialization. People specialize in various trades, and sell services to each other.
"A human being should be able to change a diaper, plan an invasion, butcher a hog, conn a ship, design a building, write a sonnet, balance accounts, build a wall, set a bone, comfort the dying, take orders, give orders, cooperate, act alone, solve equations, analyze a new problem, pitch manure, program a computer, cook a tasty meal, fight efficiently, die gallantly. Specialization is for insects." -- Robert A. Heinlein
Re:Yes. by plover · 2008-04-17 17:20 · Score: 5, Funny

What next, users have to pass an IQ test to get on the Internet?
Dear god in heaven, please let it be so!

--
John
Re:Yes. by houstonbofh · 2008-04-17 17:24 · Score: 5, Funny

What next, users have to pass an IQ test to get on the Internet? That way all of the stupid people who click on email links from phishing scams before looking at the message to see if it is fake or not, will forever see "Error ID10T: User is not smart enough to use the Internet. Request denied!"

We have those now. They are administered from a testing center in Nigeria. If you fail, your internet is soon cut off for non-payment.
Re:Yes. by Goldberg's+Pants · 2008-04-17 17:25 · Score: 2, Insightful

I love how you need a license to drive, but not to CREATE LIFE!

And people wonder why society is fucked.

And yeah, a written test to be allowed to use the internet would be nice.
Re:Yes. by Anonymous Coward · 2008-04-17 18:36 · Score: 1, Funny

If you want to get down to brass tacks and point fingers, WE are to blame for the folly of those who surround us. Yes, WE are to blame. Hey that hurts. I didn't come to slashdot to get yelled at :(
Re:Yes. by leenoble_uk · 2008-04-17 18:43 · Score: -1, Redundant

Yes let's get rid off all the other loosers!!!!
Re:Yes. by Gordonjcp · 2008-04-17 19:08 · Score: 1

If we could afford to, we will not change our own automobile's engine oil, even if we knew how to.

I can afford to pay someone to change my car's engine oil, but I don't. I do it myself. Why? Because knowing the job is done right is worth more to me than paying 40 quid each for five cars to have some spotty YTS do a bad job of putting the cheapest oil money can buy into my incredibly expensive and delicate engines. Sometimes it's not about convenience, it's about knowing it's right.

In conclusion: When a regular user choose to pay $xxx.00 for a Windows license instead of learning how to install and use Linux for free. Its a time and hassle investment that they're making, and not really a religious preference.

So they have to learn how to install and maintain Windows, which presumably means they need one of those expensive courses that Microsoft is peddling. Then they have to buy and learn how to install and maintain virus scanners. Then they need to buy and learn how to install and maintain spyware removers and firewall software and who knows what all else?

Or they could pop in an Ubuntu CD, click the "Install" icon, and walk away for five minutes and make a cup of tea. I know which I'd rather talk my 70-year-old woefully non-technical mother through over the phone.
Re:Yes. by Bert64 · 2008-04-17 20:48 · Score: 1

Not IQ tests perhaps, but there is generally a test you must pass before you're legally allowed to drive.
While a mandatory test to use the internet would help things, not all countries would enforce it at the same time. Plus, you can guarantee that the content of the test would be fucked up somehow.
It was better a few years ago, when the only people on the internet were academics and geeks, ie people who are generally fairly smart.

--
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Re:Yes. by Anonymous Coward · 2008-04-17 21:25 · Score: 0

Of course windows is to blame.

Take guns, for example. I'm actually pro-gun ownership (in fact, I'm a card-carrying member of the NRA), and I firmly believe that - as they say - guns don't kill people, people kill people.

But you know what? Gun manufacturers still put thought into their designs. They design guns to be safe to handle, to fail gracefully and so on. Now imagine that someone put a gun on the market that randomly went off, and imagine those guns had like 95% market share.

I sure would agree that in THAT case, it'd indeed be guns killing people.

And of course, you could blame the owners in that case, saying that they should know their guns are unsafe, that they should treat them accordingly, never load them, and so on.

Bullshit, I say! Guns are intended to be usable, and blaming the owner for an gun that's unsafe by design instead of the manufacturer is stupid. Same for windows. It's an OS, and it's intended to be usable; of course it can be used in a secure fashion, but most people actually want to do things like, I don't know, connect to the Internet and browse the web.

And windows is not secure enough for that.

I'm not saying that other OSes like Linux or OS X are necessarily better solutions, but even if they aren't, the fact that there's no alternatives doesn't make windows better.

So stop spouting that bull.
Re:Yes. by Opportunist · 2008-04-17 22:35 · Score: 2, Interesting

Thanks for posting this, it saves me some typing.

The only thing that changes is that the fraudsters don't have to be physically at your wallet anymore to steal your cards. ID theft has been around for as long as paying with your ID (be it CC or cash card) has been around. The only thing that changed is that they don't have to steal your card anymore, then phone you, pose as your bank and ask for your secret number to void your card. As stupid as it sounds, people fell for that.

There is one, and only one, thing we can do to make ID theft harder (not impossible, though): Educate people that their personal information is not to be handed out like candy. Unfortunately, I don't expect much help from our governments in this issue. It kinda works against their agenda.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Yes. by robably · 2008-04-17 22:45 · Score: 0

"Enclosing a sentence in Quotation Marks doesn't make it correct or profound." -- R.O.Bably

"People tend to think that their own values are the best and finest values a human being could have, that other people would do well to follow their example, and that the flaws in their own logic are virtues." -- R.O.Bably

also

"We need specialists in our society, without them we would never have flown, never have reached the moon, never have discovered DNA or black holes. That Heinlein quote is bollocks." -- R.O.Bably
Re:Yes. by Opportunist · 2008-04-17 22:50 · Score: 2, Interesting

The obvious Userfriendly cartoon to this topic: http://ars.userfriendly.org/cartoons/?id=19991114

Illiad already had that idea a decade ago. And it was already a good one back then. Unfortunately, how do you want to enforce it?

I wouldn't react with keeping the "dumb" people out. But I would highly recommend (not require, just recommend) that people get some sort of "internet 101, do's and dont's" class before hooking up. I'm honestly amazed that no bank or other financial page ever had the idea of offering such a course, free of charge. Just a few pages, informing you of the various scams and practices, as well as some counterstrategies when you think you might have already done something foolish. Setting up such a page, especially if you outsource it, runs in the four or lower five digit range. A single ID theft attack can easily reach 6 digits in damages.

So I wouldn't say that only "dumb" people fall for such scams. It's simply that people don't even think a lot of the things that happen are possible. When they click a link, they expect to visit the page this link displays, they don't even know it's possible to show a completely different URL than what you link to. And that's just the tip of the iceberg. The idea that some BHO could hook into their browser and hijack a secure transaction is completely beyond their imagination. We have to educate the users. Information is the only sensible shield against ID theft.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Yes. by Anonymous Coward · 2008-04-17 22:58 · Score: 0

Phishing has been around a lot longer than Windows and Internet Explorer
I wanted to add "[citation needed]" to that comment!
According to Wikipedia (which is never wrong), Windows (1985) pre-dates phishing (1987).
Re:Yes. by Chapter80 · 2008-04-17 23:02 · Score: 2, Funny

What next, users have to pass an IQ test to get on the Internet?
Please, nooooooo! Not until I sell my MySpace stock.
Re:Yes. by Opportunist · 2008-04-17 23:04 · Score: 1

Well, since you usually have your bank where you live, for 99% of the bigger online scams, this would already help. I'm quite amazed that banks don't press for something like this.

But how would you want to enforce it? How do you pull someone over and ask for his internet license? Or do you have to have one to get a contract with an ISP? How do you want to enforce that only people holding a license may use a computer hooked up to the net (and not, say, their kids or peers)? What if you still get infected (something that's even far from impossible for people who do know a fair lot about the threats, it's not unheard of that AV researchers themselves get infected)?

A lot of buts and ifs, and even more hows.

The internet has turned from a geek toy into a tool for everyone. Which isn't really a bad thing, it's great that everyone from 8 to 80 uses it. It do think, though, that we should educate people. And the first step has to be to inform them that the internet is not a "friendly" net. It is hostile. Every single computer out there is out to get you. Not really true, but given the large number of machines hooked up, it makes sense.

What we have to teach people is that distance does not matter on the internet. All the crooks on the net, all over the world, are living right in front of your apartment, just outside of your connection to the net. When you get someone to understand that, his first question will be how to protect himself.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Yes. by Opportunist · 2008-04-17 23:12 · Score: 1

Yay for car analogies! :)

I see your point, but it doesn't require a car mechanic to drive safely. I do agree, when my car doesn't start, I call a mechanic. I don't want to deal with engine, spark plugs and all the other greasy junk under my hood. I turn a key, if that doesn't do it, someone else is called for.

But I still have to drive. I can't just kick down the pedal to the metal and blame the car when I don't make the corner and crash instead.

And the same is true for computers. I don't expect anyone to know whether TCP/IP is some protocol or the Chinese secret service. Making a computer run and fixing it if it stops doing this is something you can (and should) outsource to someone who knows what he's doing. But that does not mean your computer should know whether you really want to do what you're doing. You still can't click on every fraud mail that comes your way, launch every invoice.pdf.exe and demand that your machine can tell whether some program you execute is "good" or "bad".

You have to turn your brains on when using a computer. I think that's a requirement you can impose on everyone, from mechanic to lawyer. It doesn't take a degree in computer science to learn that your bank doesn't send you emails asking for your online banking credentials, nor that lawyers don't send subpoenas through email.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Yes. by jimicus · 2008-04-17 23:29 · Score: 1

It was better a few years ago, when the only people on the internet were academics and geeks, ie people who are generally fairly smart. Yep, back then September was only about 30 days long.
Re:Yes. by Stanislav_J · 2008-04-17 23:34 · Score: 0, Troll

Most definitely not required to hold elected office, either.

--
"Every great cause begins as a movement, becomes a business, and eventually degenerates into a racket." -- Eric Hoffer
Re:Yes. by Giometrix · 2008-04-17 23:38 · Score: 1

"Considering their basis for this decision is some kind of market data about fewer IE7 users abandoning their accounts, yes they would be dumb enough to block free browsers that run on more secure platforms than Windoze."

What does a phishing scam have to do with how secure a platform is? Comparing browser to browser, if browser A helps protect against phishing and browser B doesn't, then browser A is more secure (in that respect). I doubt anyone that has lost money to a phishing scam would disagree.

"The whole phishing problem is one created by M$ - it would not exist without the high percentage of compromised desktop machines that are sending out spam in the first place."

What does the origin of the email have to do with protecting people who receive the email?

"IE7 is no more safe than it is standards compliant because the platform itself is easily, remotely compromised with keyloggers that report user information regardless of user activity."

1. Standards compliance has nothing to do with this argument.

2. IE7 is very secure, particularly on Vista, where the product runs on a less privileged account.

"This whole thing is stupid"

If you are taking about your post, then yes, I agree.

--
Download free e-books, lectures, and tutorials at bookgoldmine.com
Re:Yes. by jafiwam · 2008-04-18 01:10 · Score: 1

Several people have posted saying "why don't banks do X" and I just happened to hit reply on yours, so this is adding to the conversation.

Banks, as one used to think of them were the cutting edge of vault design and technology. The internet and computers however, have passed them up. You need to be dealing with a VERY big bank before you can count on professional experienced IT folks making decisions about this stuff.

For a bank, IT staff like a janitor. They don't listen to them or take them seriously.

At most small or regional banks, some goober vice president who knows nothing but thinks he does (because he installed AOL at home) is in control of the IT department.

The web site, that's managed by the youngest female member of the marketing department because she both has the most internet skills, and doesn't have the authority to push the crap jobs on someone else. So the web site itself slowly rots with more and more animated GIFs and less and less sense.

All the while, you have a large industry of fraudsters selling useless services to these banks, without anybody anywhere along the line really having a clue. They spend thousands of dollars a year on certification services, auditors, "penetration tests" (which is really just off the shelf open source programs) and then refuse to upgrade to an individual server (for an extra $20 a month) so they can lock it down to their tastes, and they won't spend $100 to get a bit of consulting to help them do it.

Also, if a bank tries to teach someone something, they take on MORE liability. Because now the lawyer has the "your training was inadequate, you owe my client".

Banks are about minimizing and mitigating risk. Teaching something, ADDS risk. So they don't do it. Telling folks that event XYZ happened and they should protect themselves just reveals they knew it was happening.

The bottom line is, they don't give a flying fuck about the end customer's individual accounts, they care about their overall accounts and what the government will do to them, they DONT care about what market forces will do to them because that's not a big threat.

Banks need their Bill Cosby of IT. Someone with pull, well respected, and known to them to go "You are doing it wrong!" Until that guy comes along, they will continue to founder.

Until then, consumers are on their own. Protect your friends and family as much as you can, but don't go insane banging your head against the wall of human IT ignorance. You can't bust through it. Only time will let it crumble as the ignorant die off in 60 years.
Re:Yes. by Opportunist · 2008-04-18 01:25 · Score: 3, Informative

First of all, thanks for belittling me. I was that bank IT guy, from 98 to 02. And contrary to your opinion, the IT staff of the average bank is quite good. It's just hard to find someone with good hacking skills and no police record these days.

What's true, though, is that the prophet ain't worth a dime in his own country. Only after I quitted and started consulting, they hired me and took me serious, essentially paying me to tell them the same thing I repeated over and over while i was there. Banks do take security serious. Mainly out of self interest. First of all, the obvious loss of money. But more important even, the possible loss of goodwill. Usually a bank settlement after a fraud takes place can be summed up as "we pay, you shut up".

So whether they're liable for the loss is moot anyway. Paying some moron the 2k he lost when his account was hijacked and ransacked is peanuts compared to bad press. Banks will pay. Even if they keep telling that they won't (this is mostly hoping people will start getting a bit more wary when doing online banking).

Banks already started to acknowledge that there is a problem. Recently we had a week long two page "bank security course" in our major newspaper. To understand the quality of this, you have to know that no paper can write anything the major banks don't want it to write (banks are amongst the most important ad buyers here, piss off the banks and you close your doors). Actually, I know it was some sort of "sponsored report", if you know what I mean.

So appearantly banks did wake up to hear the music. And when you look at their pages, they try to inform about the most recent frauds taking place, but that simply isn't enough. When you do your online banking once a week, you might already have clicked that "give info now or your account is gone" mail, without reading the warning.

What I'd envision is something like a quiz, where you can win a savings account with some token amount of money predeposited if you answer it all right. People like quizzes, especially when you can win something. The selling point would be that your bank does care about your money and your security, something that sells pretty well here (people would rather give you the keys to their home than their banking info, or tell you how much they earn, here).

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Yes. by Chapter80 · 2008-04-18 01:28 · Score: 1

There is one, and only one, thing we can do to make ID theft harder (not impossible, though): Educate people that their personal information is not to be handed out like candy.
No, there's one other thing we can do. It's probably best demonstrated by example. Reply back with your name, SSN, paypal account, and password, and I'll show you what I mean.
Oh, was I supposed to say "Trick or Treat"?
Re:Yes. by HAKdragon · 2008-04-18 01:29 · Score: 1

Well, what were you looking for, an argument?

--
"Our opponent is an alien starship packed with atomic bombs. We have a protractor."
Re:Yes. by AvitarX · 2008-04-18 01:45 · Score: 1

40 quid to change oil?

Here in the US it is 20-35 USD, even less at some decent mechanics.

40 Quid (80 USD) will get me an oil change, tire rotation (which I really can't do on my own anyway), and tanked on expensive beer at a bar).

Last time I changed my own oil it ended up costing me more in oil and a filter than my mechanic would have charged me (though with 5 cars I suppose you could get an economy of scale going).

Apparently it isn't just imports you get screwed on in England (or my entire premise is wrong and you are in Australia or something).

--
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
Re:Yes. by AvitarX · 2008-04-18 01:58 · Score: 2, Informative

I don't want to get into an argument, or act judgmental, so I apologize in advanced.

As a firm believer of the second amendment I wanted to put out there another lobby group that I personally find more reasonable:
http://www.huntersandshooters.com/

I warn you though, I believe strongly in allowing gun ownership and freedom, but also believe in requiring trigger locks, and tracking of gun ownership. Believing that the true meaning of the second amendment is to protect the opportunity for armed rebellion and against government backed militias. As such truly acting upon its intended (in my interpretation) purpose is an honorable act of treason such as the American revolution was to England, but an act of treason none the less.

Again, I do not want to start a debate, and do not mean to offend or imply my judgment is better than yours. I just wanted to put out there another group that believes in the second amendmant, that was formed by gun owners who believed the NRA was taking stand on issues not close to their hearts, and dividing and conquering the second amendment fight. Hanging gun owners in more liberal states out to dry.

Thanks if you read this far.

--
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
Re:Yes. by Anonymous Coward · 2008-04-18 02:34 · Score: 0

"Windoze" and "M$". Willy, I think you're mixing up your sockpuppets. Mactrope, gnutoo and inTheLoo are not supposed to do that. That's what prevents you from being automagically modded down. twitter and Erris on the other hand, are so far down the karma hole that they don't give a shit anymore.
Be more careful next time, please.
Re:Yes. by Pope · 2008-04-18 03:44 · Score: 1

Australia uses dollars, dumbass.

--
It doesn't mean much now, it's built for the future.
Re:Yes. by cayenne8 · 2008-04-18 03:45 · Score: 1

""Enclosing a sentence in Quotation Marks doesn't make it correct or profound." -- R.O.Bably"
"I don't need to be forgiven" -- Baba O'Riley

--
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Re:Yes. by Sly+Raskal · 2008-04-18 03:57 · Score: 1

And unfortunately, many other things.
Re:Yes. by Gordonjcp · 2008-04-18 04:16 · Score: 1

I don't live in England. Also, at least two of my cars require five litres of very expensive fully synthetic oil each. It sounds like if you're spending $20 on an oil change including labour, then you're getting cheap crappy oil.
Re:Yes. by AK+Marc · 2008-04-18 05:18 · Score: 1

Windows is not to blame for the phishing problem, PEOPLE are.

Some programs make it easier. IE allows sites to show fake addresses when you hover over them. IE allows sites to disable right-click on pages so you can't copy the link address to see what it really is before you go there. These are features put in to "help" users that decrease security. Phising isn't caused by any software, but it may be made easier by some software.

--
Learn to love Alaska
Re:Yes. by eobanb · 2008-04-18 05:28 · Score: 1

Me too!

--
Take off every sig. For great justice.
Re:Yes. by Arcane_Rhino · 2008-04-18 06:40 · Score: 1

"...and tracking of gun ownership. Believing that the true meaning of the second amendment is to protect the opportunity for armed rebellion and against government backed militias."
I don't know whether you are trolling, confused, mistyped, or I completely misunderstood you. If you believe that "the second amendment is to protect the opportunity for armed rebellion and against government backed militias", for which there is strong documentary evidence that you are correct, why on earth would you believe that tracking of firearm ownership is a good thing?
While one prays and hopes that there is never a need for armed insurrection against one's own government (and no, though many things deserve scrutiny, I don't believe that ANYTHING currently transpiring in the US even comes close to that necessity), to not only be unopposed to tracking firearm owners but actively support it seems, well... foolish. Please explain.
Re:Yes. by AK+Marc · 2008-04-18 07:48 · Score: 1

I don't live in England.

http://en.wikipedia.org/wiki/Quid From that, it looks like you are in the UK or using a local slang on a US site and guessing that we'll manage to figure out that you are using one of the least used definitions of the word. Just doing that makes you an ass. You are either ignoring your audience, or you are purposefully setting them up for failure for using an uncommon usage of the word with no clarifaction.

Also, at least two of my cars require five litres of very expensive fully synthetic oil each.

The number of cars that "require" fully synthetic oil is pretty small. For someone to own two such vehicles indicates an involvement with cars such that if oil changes were free he may still elect to do it himself out of some personal attachment to the vehicles, making price irrelevant. I own a car that does not "require" synthetic, but it is recommended (one of the last years of the aircooled 911s). The cost of buying the oil at a store in one-quart containers exceeds getting a mechanic to put in the same volume of the same synthetic into my car, changing the filter at the same time.

Oh, and I'm curious what you mean by wanting only "fully" synthetic? Are you excluding blends, or are you excluding the oils labeled as 100% synthetic that are derived from the same oil stock that makes regular motor oils?

--
Learn to love Alaska
Re:Yes. by Web+Goddess · 2008-04-18 10:01 · Score: 1

Ah yes, the September newbie influx.
I had some lurid crime photographs on my large website. In order to see these lurid crime photographs, I asked readers to prove they were "an adult by their community's standards." Most simply stated their birthdates or ages. A few sent dog tag numbers. One quipped, "I'm a resident of Washington DC. What community standards?"
Some proved their maturity by describing their life experiences. "I haven't paid off MasterCard in six years, and my car is a beat-up '80 Chevy." "I remember the words to Delta Dawn, and Michael Jackson when he was still black." "Fire hydrants were painted red, white, and blue for the 1976 Bicentennial." "There are five bordeaux grapes: Cabernet Sauvignon, Cabernet Franc, Merlot, Petit Verdot, and Malbec."
But some responses were dangerously clueless. A significant subset sent scanned licenses, passports, and photographs. A few even gave me their checking account numbers!
Are people so gullible and unaware? People are.
Re:Yes. by Gordonjcp · 2008-04-18 11:26 · Score: 1

From that, it looks like you are in the UK

The UK isn't England.

The number of cars that "require" fully synthetic oil is pretty small

Yup. One of them is a 1991 Citroen XM V6-24, which has a pretty highly-strung engine that needs lots of careful attention otherwise you're going to be replacing 24 teeny-tiny hydraulic tappets.
Re:Yes. by AvitarX · 2008-04-19 07:14 · Score: 1

I will clarify that by tracking I mean registering and reporting lost or stolen.

I don't think there should be GPS tracking or surprise inspections or anything like that (except so much as registration is kind of like that).

If someone is going to need to violate gun laws in an act of treason I think that is a risk they must be willing to take. If they are not, the treason is probably ill-advised.

In many parts of the county there is a serious problem of guns ending up in the underground and the owners that allowed it to happen are not accountable at all.

Allowing people to move many guns into an underground where they are being actively used and killing bystanders is a bad thing. And a peace of freedom that leads to a very real increase in security.

I think a reasonable way to decrease the amount of control government has on firearms is to increase the amount of accountability owners have when there gun kills an innocent bystander.

It's hard enough to be a cop without somebody giving there pistol to the guy you are arresting and then saying "It was stolen 6 months ago".

I also think we have things a little backwards, and it is worrying to me. A small gun (pistol for example) is far more dangerous to me than an assault rifle, or even a militarized one (fully automatic). And a pistol is not particularly useful in armed rebellion.

And yes, I am probably confused.

--
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg

Another one... by Anonymous Coward · 2008-04-17 14:39 · Score: 2, Funny

Dear PayPal User,

Due to recent security upgrades, you may no longer be able to log in. In order to give all our customers the highest level of protection against fraud and identity theft, we are requiring that you have up-to-date security measures on your computer.

Please install the enclosed program [malware.exe] to upgrade the security of your computer to ensure that you can continue to access your PayPal account.

Thank you,
- Scams R. Us

Netcraft seems to have a slightly different take by micheas · 2008-04-17 14:40 · Score: 5, Insightful

Paypal is hyping Extended Validation certificates after Netcraft posts articles like this:

Extended Validation certificates and XSS considered harmful

Curious if nothing else.

--
Work bio at MMWD

They have not even gotten that far. by Mactrope · 2008-04-17 14:42 · Score: -1, Flamebait

People who run Safari are not idiots and PayPal does not have any data indicating one browser is any more secure than another. The only basis for this stupid policy is that IE7 has some kind of anti-phishing and they noticed that IE7 users don't abandon PayPal as frequently as users of other browsers. That's it, leap of logic and case closed.

M$ has it's hooks deep into PayPal for them to say crazy shit like that.

--
http://slashdot.org/comments.pl?sid=216934&cid=17629948

Who are they to decide what is and isn't safe? by Antony-Kyre · 2008-04-17 14:44 · Score: 5, Insightful

Who are they to decide what is and isn't safe? They're not a bank, so I don't think they necessarily have any liability if one of their customers loses money, correct? Please correct me if I am mistaken.

Is this even legal? Seriously. If someone has money in PayPal, and if that same someone happens to be using a browser that is deemed "unsafe" and is sequentially banned, isn't that like PayPal holding the money hostage? What happens to those who refuse to "upgrade" in order to access their account?

Maybe instead of doing stupid stuff like this, which breeds a false sense of security among some less-smart users of PayPal, they should think of new and innovative ways to prevent unauthorized access to accounts. (I don't care to list my ideas right now.)

Re:Who are they to decide what is and isn't safe? by corsec67 · 2008-04-17 14:49 · Score: 1, Troll

You aren't at all mistaken:

Paypal doesn't give a shit about anything but making money from themselves, and don't hesitate to take money from anybodys account for almost any reason.

PayPalSucks.com

It is kind of silly, forcing people to access PayPal with secure browsers when money stored at PayPal isn't secure from PayPal itself.
(PayPal isn't a bank, nor does it even try to pretend to be one, so don't let them have any EFT account numbers, and never store any money there.)

--
If I have nothing to hide, don't search me
Re:Who are they to decide what is and isn't safe? by Anonymous Coward · 2008-04-17 14:51 · Score: 0, Insightful

It is their website. They have every right to support certain browsers and to use it, you accept their ToS.

Grow up.
Re:Who are they to decide what is and isn't safe? by RiotingPacifist · 2008-04-17 14:58 · Score: 1

gunna have to disagree on this one, thier test is fairly simple.
Does it have fishing protection?
yes = allow
no=recommend one that does.

OFC its legal, they're not forcing you to pay anybody anything, and people have been forced to use a certain browser for sites for years. hopefully they will do it via user strings, and assume anybody that is smart enough to fake a userstring is smart enough to not get phished.

--
IranAir Flight 655 never forget!
Re:Who are they to decide what is and isn't safe? by Anonymous Coward · 2008-04-17 15:07 · Score: 2, Insightful

Not the same. They certainly would care if their customers lose money - PayPal isn't the only fish in the online payment sea, though it is the largest. If phishing becomes too common it impacts their image and reputation as a safe way to shop.

And of course it's legal. Considering at least one allowed browser is FREE, and is available to basically every platform out there (Firefox), there's no burden on the consumer to have a "safe" browser.

That's like complaining that your bank inconveniences bike riders by being in a location only accessible by car. Bad business decision perhaps, but far from illegal.
Re:Who are they to decide what is and isn't safe? by Anonymous Coward · 2008-04-17 15:15 · Score: 0

(PayPal isn't a bank, nor does it even try to pretend to be one, so don't let them have any EFT account numbers, and never store any money there.) Sure you can.

When you get your PayPal account, just give them the account number of a SAVINGS account. They can do their EFT test deposit in, but they can't suck anything out.

But yeah, don't keep any money there just in case.
Re:Who are they to decide what is and isn't safe? by hendridm · 2008-04-17 15:42 · Score: 1

Who are they to decide what is and isn't safe?

That's what I was thinking, sort of. Requiring a "safe" browser seems about as effective as the TSA - some bogies get through, some grannies get nailed.
Re:Who are they to decide what is and isn't safe? by Sycraft-fu · 2008-04-17 17:50 · Score: 1

They are a payment processing company, that's who. It is well within their rights, or indeed any businesses rights, to decide how they want to do business. It is totally legal. You can't tell a business how they have to run their business. They are free to accept payment in only forms they like, they are free to put requirements on their business and so on. For example Costco requires you to be a member to shop there. They can do this, there's nothing illegal about it. They are free to refuse your business if you don't get a membership. As perhaps a more on point example, many payment processors require you to use hardware specific to them. My parents use Paymenttech to take credit cards and the only equipment that works is sold by Paymenttech themselves.

If you don't like it, don't do business with PayPal. If they lose enough business, they'll change.

As a side note, they ARE doing other things to improve security. If you want you can get a keyfob for your account. Costs you $5. It's more or less the same technology as an RSA SecureID. Generates a unique code every 30 seconds, and you have to enter that code to log in. If you want that security, just order one from PayPal.

That's better security than I get out of my bank. So it seems that maybe PayPal is taking security seriously.
Re:Who are they to decide what is and isn't safe? by floki · 2008-04-17 19:55 · Score: 1

Who are they to decide what is and isn't safe? They're not a bank, so I don't think they necessarily have any liability if one of their customers loses money, correct? Please correct me if I am mistaken.

They are indeed a bank and as such have all the liabilities of a normal bank. They became a bank about a year ago.

--
from the to-stupid-for-words dept.
Re:Who are they to decide what is and isn't safe? by Anonymous Coward · 2008-04-17 20:00 · Score: 0

Nothing illegal about it, most real banks' websites won't work on very old browsers, doesn't mean they are holding your money hostage; call them up and authorize your transfers.

If people are unwilling to upgrade to a more secure version of a browser, obviously they're the one to lose in the end.

The financial institute rightfully should place security above convenience.
Re:Who are they to decide what is and isn't safe? by Serious+Callers+Only · 2008-04-17 20:19 · Score: 1

If phishing becomes too common it impacts their image and reputation as a safe way to shop.

Paypal is not a safe way to shop, and they certainly don't have a reputation for being safe or protecting their users. If the phishers don't steal your money, paypal will, so the real solution to this problem is to avoid paypal transactions. I'd never leave money with them or trust them with my card details.

It is of course legal to demand users use a certain browser, if a bit stupid. There are many safer ways to secure the transaction - require local certificates to sign in, two factor authentication, don't sent out emails to your users, etc etc. If Paypal send out emails, they should be signed and verifiable - they could easily provide a small application to verify emails were real, or use the stuff already built in to some email clients.
Re:Who are they to decide what is and isn't safe? by Antony-Kyre · 2008-04-17 22:07 · Score: 1

But if one's browser is banned from getting into one's account on PayPal, will you be able to call up PayPal to have one's funds transferred someplace else?
Re:Who are they to decide what is and isn't safe? by Antony-Kyre · 2008-04-17 22:10 · Score: 1

They're just a bank in Europe though, correct? They're not considered a bank in America, are they?
Re:Who are they to decide what is and isn't safe? by base3 · 2008-04-17 22:52 · Score: 1

And when they can't suck any money out, the have enough information on you to send you to collections and mangle your credit, so using a non-debitable or "chump" account with very little money in it is not a fix for getting screwed by PayPal.

--
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
Re:Who are they to decide what is and isn't safe? by floki · 2008-04-17 23:03 · Score: 1

Yes, in Europe. Don't know about America.

--
from the to-stupid-for-words dept.
Re:Who are they to decide what is and isn't safe? by kabocox · 2008-04-18 01:01 · Score: 1

Is this even legal? Seriously. If someone has money in PayPal, and if that same someone happens to be using a browser that is deemed "unsafe" and is sequentially banned, isn't that like PayPal holding the money hostage? What happens to those who refuse to "upgrade" in order to access their account?

I think the "smart" thing to do would be never to keep money at PayPal. I've heard far to things about that "not a bank" yet acting like a bank to me business that I'd ever willing use them for my internet money transfers. If your business demands that I use PayPal, I shop else where. I've always thought smart internet shoppers did the same. There is enough choice online that if a business is doing something slightly annoying that you don't like, then you can go else where. Boycotting does change businesses.

I consider those that get burned on PayPal as paying yet another tax on stupid people. (It's one of those hidden life taxes that anyone can avoid, but if you live life stupidly, then you are going to be paying for it sooner or later.)
Re:Who are they to decide what is and isn't safe? by yabos · 2008-04-18 07:12 · Score: 1

And all this while eBay is looking to make Paypal the only way to pay for their auctions. That also wreaks of anti-trust. I guess I can say goodbye to eBay and PayPal at the same time!

What about Lynx? by homerj79 · 2008-04-17 14:45 · Score: 4, Funny

Is Lynx still considered unsafe? Have they fixed that graphics display hole yet? That was reported, like, 20 years ago.

--
SYSOP ('sih-sop) n.: the guy laughing at your typing.

Re:What about Lynx? by indi0144 · 2008-04-17 16:57 · Score: 0

It's safe now! that graphics bug still around but you can read the captchas in ascii art.
Re:What about Lynx? by Hal_Porter · 2008-04-17 18:30 · Score: 1

I read some copypasta on a site that made me feel ill for ages. I wrote a textblock patch, but it hasn't been accepted yet.

--
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;

How about the other way around? by failedlogic · 2008-04-17 14:45 · Score: 5, Insightful

How about the other way around? Have safe browsers ban PayPal!

Re:How about the other way around? by iscariota · 2008-04-18 04:06 · Score: 1

What if security isn't really the only reason PayPal would ban a browser. What if other "reasons" are taken into account? What if safe browsers (or possibly people behind them) "know" about these other "reasons"? PayPal is widely used: It could have quite a big impact on global browser usage...
In this case, it would be counterproductive (or better it wouldn't make sense) for "safe" browsers to ban PayPal.
I know, I'm just paranoid ;-)
Re:How about the other way around? by failedlogic · 2008-04-18 13:31 · Score: 1

I actually found it funny that I was modded insightful and even more so that I was critiqued for my post. It was sarcasm. iscariota your post is definitely intended to be more "informative" than mine ever was. I was hoping for some "funny" karma and instead my karma is rated "serious" all of a sudden. Sheesh! I can't win at all....

Gypsies in the palace... by VeryVito · 2008-04-17 14:47 · Score: 1

Paypal warning against internet fraud seems a lot like Michael Jackson speaking against child exploitation. The company has a history of making money just disappear. "You must use a secure browser so that we may have unregulated access to your banking account. Otherwise, somebody might be able to stop us."

First, Ebay Should BAN Sending Email to Users by Ron+Bennett · 2008-04-17 14:47 · Score: 5, Insightful

And yet, Ebay still sends email to users regarding important matters despite the security risks that poses - ie. how can a user know the email is real, it's not encrypted, etc.

Instead of banning browsers, Ebay should address the bigger security issue of Ebay sending email to users - instead Ebay should only send notices simply saying one has new messages in their Ebay message center, and require the user to actually visit Ebay to view the message contents - not fool-proof, but would substantially reduce the effectiveness of email spoofs.

Ron

Re:First, Ebay Should BAN Sending Email to Users by Nushio · 2008-04-17 14:59 · Score: 5, Insightful

Dear eBay User,

There is a new message waiting for you. You may login into here to access it.

Sincerely,
eBay Scammer.

--
Check out Unsealed: Whispers of Wisdom! http://unsealed.k3rnel.net It's an action-RPG about Open Sourcerers.
Re:First, Ebay Should BAN Sending Email to Users by SpottedKuh · 2008-04-17 15:08 · Score: 3, Insightful

Ebay should only send notices simply saying one has new messages in their Ebay message center, and require the user to actually visit Ebay to view the message contents - not fool-proof, but would substantially reduce the effectiveness of email spoofs.

One very important thing they would have to do is include some sort of identifying information, otherwise this would open the door to some very easy phishing attacks (as per Nushio's sibling comment).

Perhaps in your eBay account, you could choose one from several thousand little pictures (e.g., as you do with video games and video game systems to choose an avatar picture). Then, the messages could read something like:

Dear SpottedKuh: [picture of a little cow that I chose] ... check your eBay message centre, etc.

Then again, I think things like this have been tried before (don't some banks do something similar to this when you log in?) I guess if the users don't care to pay attention, they won't notice the difference between what I wrote above and:

Dear eBayUser: [picture of random anything] ...
Re:First, Ebay Should BAN Sending Email to Users by bendodge · 2008-04-17 15:46 · Score: 1

Even better than choosing some random thing G-Ma might forget would be requiring (or at least pushing) her to upload her own photo.

Personally, I think this is a great thing. Finally, people will have major incentive to upgrade from IE5 and 6, the bane of web developers.

--
The government can't save you.
Re:First, Ebay Should BAN Sending Email to Users by Spacejock · 2008-04-17 16:15 · Score: 1

For security reasons my email prog doesn't render html, nor display images of any kind. Therefore, to verify you really ARE eBay, please post me a $100 note. On receipt of this note, I promise to post it back along with the information you're requesting from me.

--
Hal Spacejock: Science Fiction with Nuts
Re:First, Ebay Should BAN Sending Email to Users by Anonymous Coward · 2008-04-17 16:43 · Score: 0

You have stated a thing I dream of: not only will it reduce the risk of spammers, I don't have to delete the "thing to sell of the week" emails anymore!
Re:First, Ebay Should BAN Sending Email to Users by clickety6 · 2008-04-17 20:10 · Score: 1

Educate users to always enter the right username but THE WRONG PASSWORD first time. If the site accepts it - you've been phished! :-)

--
----------------------------------- My Other Sig Is Hilarious -----------------------------------
Re:First, Ebay Should BAN Sending Email to Users by xaxa · 2008-04-17 21:44 · Score: 1

They already do, to a point. Email from eBay go something like

"Dear Joe Bloggs (jblog23).

eBay includes your member name (jblog23) and your registered name (Joe Bloggs) to prove this email is from us. Really."

The problem is, I've seen phishing emails:

"Dear jblog23 (jbloggs@example.com)

eBay includes your member name and your email address to prove this email is from us. Please visit this .cn-registered site and give us your money. All of it."

A picture would be better, if people remember to look out for it.
Re:First, Ebay Should BAN Sending Email to Users by matt+me · 2008-04-17 22:59 · Score: 1

Messages from one of my banks are signed using PGP.
Re:First, Ebay Should BAN Sending Email to Users by Jesus_666 · 2008-04-18 08:03 · Score: 1

Dear eBay staff,

The link you sent me returned a 404 error. Can you send me the data via some other way? I can privide my home address and telephone number.

Sincerely,
Gullible I. Diot

--
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
Re:First, Ebay Should BAN Sending Email to Users by LiquidFire_HK · 2008-04-19 22:56 · Score: 1

It's an interesting idea, but (as with most of these) if it catches on, scammers will simply adjust.

How much does it cost to become a "safe" browser? by shatfield · 2008-04-17 14:48 · Score: 1

Wow, PayPal has figured out #2!

1) Declare a browser as "unsafe"

2) ???^H^H^H^H^H^H
2) Block the browser from your popular site

3) Profit! --> Approach the company that makes the browser... "we'll declare it safe... for a price".

--
"To make a mistake is only human; to persist in a mistake is idiotic." Cicero

What about older OSes? by Anonymous Coward · 2008-04-17 14:51 · Score: 1, Interesting

What if you're on an older OS (e.x. Windows 2000) and you don't have access to a browser that supports EV SSL?

This sounds like eBay trying to get too controlling of PayPal users. I have a feeling that "security" might mandate a browser plugin in the future to verify that you are viewing the real paypal site (coincidentally, it automatically fills out transaction information if PayPal is the payment method)....

Re:What about older OSes? by Orion+Blastar · 2008-04-17 15:00 · Score: 3, Informative

They can always download and install Firefox. Then install an anti-phishing addon.

Firefox works as far back as Windows 95 IIRC? I installed Firefox on my uncle's Windows 98 box, the only issue was that the start bar title icon didn't show up properly but it ran.

Sure he can't use his iPod with Windows 98, but Firefox works great. If he gets a RAM upgrade he can run Windows 2000. But technically with 128M of RAM or more he can run Windows XP on his 333Mhz processor, but it will be really slow.

I don't think we can afford to buy a new machine, and his old machine runs great.

--
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
Re:What about older OSes? by Anonymous Coward · 2008-04-17 16:17 · Score: 0

What if you're on an older OS (e.x. Windows 2000)

Congratulations on using a well-known, well-understood, well-documented OS that isn't full of activation and DRM crap.

and you don't have access to a browser that supports EV SSL?

EV SSL is useless. It's a scam by the Certificate Authorities to cover up the fact that they do virtually no checking before issuing certificates.
Re:What about older OSes? by Anonymous Coward · 2008-04-17 16:19 · Score: 0

Firefox 2 will be the last version that runs on Windows 98, and Firefox 2 will be end-of-lifed 6 months after Firefox 3 is released. So you have about 8 months to switch to Linux or get a cheap new computer.
Re:What about older OSes? by Kelson · 2008-04-17 16:50 · Score: 1

Firefox works as far back as Windows 95 IIRC? I installed Firefox on my uncle's Windows 98 box, the only issue was that the start bar title icon didn't show up properly but it ran. Firefox 2, yes, and it has some built-in phishing detection (though not support for EV certs). Firefox 3 uses some libraries that don't run on the Windows 95/98/Me series, and will only run on Windows 2000 or later.

I believe Opera will still run on the Win9x series, and Opera 9.5, like Firefox 3, will support EV certificates. They're apparently working up to a second beta any day now, so the final release could be out this summer. Opera's free as in beer, so it should be another option for your uncle's computer.
Re:What about older OSes? by toddestan · 2008-04-18 15:33 · Score: 1

Luckily, Firefox is open source so you could get Firefox 3 to run on Windows 98 if you wanted to spend the time to do it. Or you could look around the internet and see if anyone else did the work for you.

How valuable are EV SSL certs? by LoadWB · 2008-04-17 14:52 · Score: 5, Interesting

If you want to try a new conspiracy on for size, maybe this is also a chance to try to push the use of EV SSL certificates.

I have attended several of the webinars and read a number of the white papers on EV SSL certificates, and I am not completely sold on the usefulness.

Sure, thorough validation of a requester's right to purchase an SSL certificate is a good idea. That should be done already for any SSL purchase, but it is and will not be done because it makes the process too difficult, time consuming, and expensive. Well, too expensive for GoDaddy to sell a $20 certificate and thoroughly validate it, but for the $350+ Verisign certificates? Please...

More to the point, older browser showed a lock icon which indicated the site was secure. With the ease of SSL certificate purchases that quickly became less important because even phishing sites can have valid certificates. The EV SLL scheme is to put up a BIG GREEN BAR with the issued company's name in it. Why not just do that anyway? Those notification bars that come up when a pop-up is blocked, or an ActiveX control wants to install, or a file wants to download; how about use that to show critical information in the certificate, like the CN?

Sure, the URL says www.paypal.com, but the certificate CN says "www.phishingurinfoz.ru".

But then, I suppose a little Java and no protection of that particular window element could lead to a phalse display.

Re:How valuable are EV SSL certs? by TubeSteak · 2008-04-17 16:15 · Score: 1

Sure, the URL says www.paypal.com, but the certificate CN says "www.phishingurinfoz.ru". Sure, the URL says www.paypal.com, but the certificate CN says "www.paypa1.com".
Sure, the URL says www.paypal.com, but the certificate CN says "wwwpaypal.com".
Sure, the URL says www.paypal.com, but the certificate CN says "www.paypals.com".
Sure, the URL says www.paypal.com, but the certificate CN says "www.baypal.com".

That'll be more than enough to fool some of the people all of the time.

--
[Fuck Beta]
o0t!
Re:How valuable are EV SSL certs? by LoadWB · 2008-04-17 16:42 · Score: 1

Rise up machines, because humans are the weakest link! heheheh

No, good point. And the idea would need to be refined even more.

You know, maybe we can sue the font-setters who made courier new l look like 1.

Now I have to think of a better way, and I have a headache already. Thanks!
Re:How valuable are EV SSL certs? by weicco · 2008-04-17 21:32 · Score: 1

SSL and sertificate isn't necessarily enough. Ask Finnish Sampo bank for instance. They opened up a huge XSS hole on their website where specially crafted URL could do wonders. Sertiface said sampopankki.fi, URL said sampopankki.fi, lock icon was visible, but the actual content was downloaded from evilwebsite.com.

--
You don't know what you don't know.
Re:How valuable are EV SSL certs? by tokul · 2008-04-17 23:46 · Score: 1

Sure, the URL says www.paypal.com, but the certificate CN says "www.phishingurinfoz.ru".
Fix your browser. It should warn you when CN and URL don't match.

How about this? by TheSpatulaOfLove · 2008-04-17 14:54 · Score: 3, Insightful

Can we ban Paypal for unsafe money exchange?

Re:How about this? by dhaines · 2008-04-17 15:44 · Score: 1

Lately I've had a transactions where the site (not eBay) used a Paypal cart. Each time I contacted the merchant and requested another way to order/pay. Most of them mentioned how many complaints they hear about Paypal. One business gave me a $24 order for free because I detailed in writing why I won't use Paypal. All but one of the others either had a different merchant account or sent the order with an invoice, trusting me to send payment. Only one lost my business because they "had" to use Paypal.

Paypal would be way more safe if they'd just ban all browsers.

Re:Netcraft seems to have a slightly different tak by jd · 2008-04-17 14:56 · Score: 4, Funny

Netcraft is dead. Paypal confirms it. And E-bay swapped it for some military hardware.

--
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)

1 more step to go. by WK2 · 2008-04-17 14:56 · Score: 1

Now the scammers/phishers just need to do the same thing. And voila!

--
Write your own Choose Your Own Adventure. http://www.freegameengines.org/gamebook-engine/

Unsafe for any user. by Mactrope · 2008-04-17 15:02 · Score: 0, Flamebait

So you just want to ignore the whole botnet thing that's creates the opportunity to screw up? That's a bad idea because everyone makes mistakes. Some make fewer than others but everyone will fail given enough chances. This also points out the futility of Paypal's ill advised action. The platform is insecure so their little green bandaid is not going to fix anything.

Pay Pal does not really have or they have chosen not to publish what browsers are "safe" based on actual fraud. Safari and other blocked browsers would not be at the top of that list, but any version of IE would and let's face it, IE 7 users are pushovers likely to get screwed. Windows itself is unsafe with anyuser, so the whole thing is just stupid.

--
http://slashdot.org/comments.pl?sid=216934&cid=17629948

Re:Unsafe for any user. by LoadWB · 2008-04-17 15:18 · Score: 2, Insightful

No more than we walked away from the telephone, fax machine, and postal mail. I simply found folly in your statement that the whole phishing thing was Microsoft's fault. Put blame where responsibility falls, on people who manage important data.
Re:Unsafe for any user. by Mistshadow2k4 · 2008-04-17 16:44 · Score: 1

I am replying to this to undo the accidental bad moderation I gave you. My apologies, my cat was distracting me at the moment. But you're very right; phishing was around before the desktop computer. I well remember the junk mail my parents got when I was a kid that ran from somewhat to nearly the same as the phishing scams seen today. I'm guessing that a lot of ./ers are just too young to remember that.

--
I dream of a better world... one in which chickens can cross roads without their motives being questioned.
Re:Unsafe for any user. by BlackSnake112 · 2008-04-18 03:05 · Score: 1

I still get the phone calls from people wanting to clear all of my credit card debt. Phishing has been around a long time. Also isn't this mactrope a twitter sock puppet or is this the real one?
Re:Unsafe for any user. by Anonymous Coward · 2008-04-18 08:52 · Score: 0

Yeah that's one of fuckin' Twitter's accounts. That cancer on FOSS has several accounts including Mactrope, Gnutoo, InTheLoo and Erris. Damned shit stain...

Paypal blocks unsafe browsers... by russotto · 2008-04-17 15:03 · Score: 5, Funny

...but the head of the International Phishers Guild says that all of their sites will continue to work with any browser you want. Spokesman Anome Smith says "We will not be following Paypal's lead on this. Popular phishing sites like www.payypal.com, www.paypa1.com, and 192.168.178.287/paypal will all continue to work with any browser you please. "

stupid and pointless by Thaelon · 2008-04-17 15:04 · Score: 3, Insightful

This is stupid and pointless.

The problem isn't "unsafe browsers". Phishing is social engineering, not hacking. The problem is unsafe users.

Give a stupid user a safe browser and a semi-sophisticated phish and they'll cough up that login.

Give a smart user a IE 5.0 and they'll never get busted.

If paypal really wanted to increase user safety they'd do it with user education.

Tell users to very carefully navigate to the correct site, make a bookmark, and then never go to the site any other way again.

--

Question everything

Re:stupid and pointless by Anonymous Coward · 2008-04-17 15:46 · Score: 0

A UCLA study shows that people are willing to click on anything.
Re:stupid and pointless by Anonymous Coward · 2008-04-17 16:08 · Score: 0

They tried that, no one listened, or there is a steady stream of new fools to replace the old users that either dropped out of using the internet to do that sort of thing, or upgraded to a new computer, with the latest browser. User education won't succeed anymore than teaching 10th graders something, only to have a new batch show up for the 10th grade next year.
Re:stupid and pointless by tokul · 2008-04-17 23:49 · Score: 1

Give a smart user a IE 5.0 and they'll never get busted.
Paranoid is not same thing as smart.
Re:stupid and pointless by MagdJTK · 2008-04-18 03:05 · Score: 1

Tell users to very carefully navigate to the correct site, make a bookmark, and then never go to the site any other way again. Dear valued user,
Paypal is rolling out some great new features this month and in preparation we are asking our customers to update their bookmarks. Please follow the following link and replace your current Paypal bookmark:

www.paypal-not-a-scam.com

Thank you for your custom,
Paypal

Will take my business elsewhere by wshwe · 2008-04-17 15:09 · Score: 2, Interesting

eBay and PayPal have demonstrated that they no longer deserve my business.

Re:Will take my business elsewhere by pembo13 · 2008-04-17 15:46 · Score: 1

By wanting you to use a secure browser that works on your platform?

--
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft

Marlboro Virginia Blend: Chain Smokers Rejoice! by Anonymous Coward · 2008-04-17 15:10 · Score: -1, Offtopic

The distinctive, gold-trimmed platinum box is the first deviation from the signature Marlboro design. Even the top of the box bears the blue leaf stamp to the right rather than across the middle, as displayed on soft packs. Aside from the black "MARLBORO," the rest of the lettering is burgundy.

The cigarette itself looks like...a cigarette. No fancy changes besides the platinum band at the base of the filter.

I purposely smoked two Virginia Blends before I even read the descriptive marketing phrases on the cigarette box. I wanted no power of suggestion clouding my mental capacity to judge the new addition to the plethora of Marlboro smokes. Unlike most consumer products, the absence of cigarette commercials eliminates their suggestive power over the cigarette smoker. So it was easy to experience the difference this single leaf blend purported.

To my delight, the flavor and inhalation were both smooth and mild. My lungs were not arrested by the typical asperity that normally impedes the smoking experience. As a habitual menthol lover, I am used to an extra amount of crystallizing lung pressure. Even with the brown sugar laced Marlboro 27s, I get that extra hacking the morning after; therefore, I was ready for some harsh ingredient to mar any chance at a deep drag.

Not so.

Upon lighting the third grit, I fancied a glance at the burgundy message on the back of the box: "VIRGINIA LEAF. 400 years ago perfected in Virginia--now grown around the world. Today, hand-selected Virginia tobaccos make our only single leaf blend unique. Enjoy the crisp, mellow taste and easy finish."

There it is, in the last sentence. The power of suggestion exposed: "...crisp, mellow...easy."

Easy Phish - Thank you Paypal by fireheadca · 2008-04-17 15:18 · Score: 5, Funny

Paypal not letting you in?

Have no fear.. with paypalproxy.com you can use any browser to access your account.

--
So long and thanks for all the phish.

Re:Easy Phish - Thank you Paypal by Jax7 · 2008-04-18 04:00 · Score: 1

Paypal not letting you in?
you must be using IE. aren't u?

PROTECT YOUR PASSWORD by hendridm · 2008-04-17 15:28 · Score: 1

I received the following at the bottom of a message from PayPal confirming a funds transfer:

"PROTECT YOUR PASSWORD

NEVER give your password to anyone, including PayPal employees. Protect yourself against fraudulent websites by opening a new web browser (e.g. Internet Explorer or Netscape) and typing in the PayPal URL every time you log in to your account."

I am an unhappy customer by prxp · 2008-04-17 15:34 · Score: 4, Insightful

I am a PayPal customer. I have a paypal secure ID, a hardware token that generates 6 digits numbers (synchronized with paypal's servers) that are part my password authentication process. That means that even if someone gets my password (i.e. fisher), they won't be able to login that easily (they would need the hardware token to generate the current 6 digits number set, which changes periodically every 30 seconds). With all of that, I see no reason for paypal to block me if I am using Safari, even if Safari is a bit unsafer than other browsers. That would just mean adding an extra item to the list of things my iPhone can't do: access PayPal's webpage. That would really piss me off.

Re:I am an unhappy customer by LoadWB · 2008-04-17 16:24 · Score: 1

Excellent point. Keep collecting mod points...
Re:I am an unhappy customer by Apple+Acolyte · 2008-04-17 16:54 · Score: 2, Informative

I reject the notion that Safari is less safe than other browsers. There have been very few serious security flaws found in Safari, even after Apple opened the platform to Windows. I'd say Safari is one of the most secure browsers out there.

--
Part of the hardcore faithful who believed in Apple long before it was cool again to do so
Re:I am an unhappy customer by Kamineko · 2008-04-17 20:30 · Score: 1

'fisher'? That's a terrible password!
Re:I am an unhappy customer by weicco · 2008-04-17 21:30 · Score: 1

So there is a lot to discover then...

--
You don't know what you don't know.
Re:I am an unhappy customer by avandesande · 2008-04-18 03:52 · Score: 1

I use yahoo mail, which warns you when you get a mal-formed email. There are more ways to avoid pfishing attacks than just the browser.

--
love is just extroverted narcissism

If Paypal wanted to slow phishers by CrazyJim1 · 2008-04-17 15:40 · Score: 2, Interesting

I'm not sure if there is a word for this(Phish and release), but it goes like this:
Paypal should send out official looking emails with links to a site that isn't on Paypal.
If someone enters their information on this fake site, Paypal would warn them that they got phished and released!
Paypal could tell them important stuff like only manually going into paypal.com and never clicking on a link in an email.

--
God spoke to me.

Re:If Paypal wanted to slow phishers by maxair_mike · 2008-04-17 17:00 · Score: 1

Unfortunately, there are too many websites that require you to activate your account by clicking on a link in your email. Even though I consider myself a decent bit smarter than your average Joe when it comes to computers and security, I didn't even think about that problem until now, reading about it. With simple HTML, you can have a URL display as a perfectly unambiguous URL, when in fact it is malicious (in the sense that it wasn't intended for proper use, not in the code sense).
Re:If Paypal wanted to slow phishers by dword · 2008-04-18 21:22 · Score: 1

Please read my sig. I rest my case.

Education? Hardly a solution! by v(*_*)vvvv · 2008-04-17 15:49 · Score: 1

3 reasons:

1) It takes time and effort for everyone involved

2) There will always be people who don't get it

3) There will always be newcomers

Yes, "knowing" is a good thing. However it is something the educated often take for granted because they believe the problem only applies to the uneducated, and they aren't the one's responsible for the education. Well, if it did apply to you you would be "surprised", and if you had to do the teaching, you'd try and think of something else once you realized what a waste of time it was.

Lazy Unregulated Global Banking Monopoly by Doc+Ruby · 2008-04-17 15:55 · Score: 1

A lot less phishing would go on if PayPal would just enforce it's trademark and force the FBI to investigate these phishers using those marks to compete with PayPal and rip off its customers.

All these banks should be doing that. The FBI should be busy protecting us from these modern bank robbers, not all the domestic snooping and other abuses they waste their time and our money on.

Trademark holders are supposed to lose their trademarks when they don't defend them against imitators. Banks are supposed to secure their transaction systems from fraud.

I guess since they're making so much money doing their bad jobs, they don't miss it much when we lose our money. They'll just get it back when the phisher deposits it in their own accounts later.

--

--
make install -not war

Re:Lazy Unregulated Global Banking Monopoly by CrazyJim1 · 2008-04-17 16:27 · Score: 1

I once turned some phishers into the FBI, but you're probably right in that they're not doing enough. I think part of the problem is that cyber-crime is global. So someone could be in Zimbabwe and stealing money from Canadians. Who enforces that?

--
God spoke to me.
Re:Lazy Unregulated Global Banking Monopoly by Anonymous Coward · 2008-04-17 16:46 · Score: 0

But trademark enforcement is expensive. The company has to pay for that out of their pocket.

It's much cheaper and profitable to just steal money from your customers. That's what Paypal has done for years. It's very effective taking a few thousand from a few customers per day. Paypal knows that for the amounts they steal it isn't cost effective for someone to sue them and with their tie-in with eBay they know most of their victims can't afford to quit using them.

Why spend thousands to protect a trademark when you can just steal?
Re:Lazy Unregulated Global Banking Monopoly by Doc+Ruby · 2008-04-17 16:50 · Score: 1

The FBI routinely conducts global criminal investigations, or just foreign ones. The locations of the phishing servers, and the trails of traffic among them, are often published, so focused covert investigation could probably bust at least a few rings.

Except that the FBI doesn't seem interested. Not as interested as it is in all manner of crap that doesn't protect us from anything.

--
--
make install -not war
Re:Lazy Unregulated Global Banking Monopoly by Apple+Acolyte · 2008-04-17 17:02 · Score: 1

Hey Doc, you don't know what you're talking about when it comes to trademarks. Trademark violations are usually a civil matter and not something the FBI would bother with. Now investigating fraud is obviously part of the FBI's domain. Also, trademark holders don't lose their trademarks if they fail to enforce their rights; they only lose the opportunity to obtain relief from an equity judgment (like an injunction) from a court and instead have to go through the longer and much more expensive litigation of a full case. IANAL.

--
Part of the hardcore faithful who believed in Apple long before it was cool again to do so
Re:Lazy Unregulated Global Banking Monopoly by Hal_Porter · 2008-04-17 18:54 · Score: 1

Yeah, I can just the FBI sending Agent Scully to check out some eBay scammer in Zimbabwe.

--
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Re:Lazy Unregulated Global Banking Monopoly by Doc+Ruby · 2008-04-18 01:57 · Score: 1

When the mark holder fails to protect their mark from dilution, without taking aggressive steps to prevent the confusion in the market, they can lose their exclusive rights in the mark. Those steps include at least sending the violator a cease & desist message.

Since these trademark infringements are used to defraud banking, interstate and internationally, over wire services, I expect the FBI would find jurisdiction.

--
--
make install -not war
Re:Lazy Unregulated Global Banking Monopoly by Doc+Ruby · 2008-04-18 02:22 · Score: 1

That's because you watch too much TV. And because Zimbabwean scammers are abusing the Psychic Friends Network, so Scully is required.

--
--
make install -not war

Prime example by v(*_*)vvvv · 2008-04-17 16:00 · Score: 4, Insightful

... of where the Terrorists won.

Ironically, phishing sites won't block users using "unsafe" browsers, which just makes them more user-friendly than paypal.

Re:Prime example by sasdrtx · 2008-04-19 06:55 · Score: 1

Well, duh. How is Paypal blocking "unsafe" browsers going to have any effect at all on people going to phishing sites? As you said, a phisher is perfectly happy for you to use an "unsafe" browser.

And what do they think people who fall for phishing scams are going to do about it? Upgrade their browser? Please.

--
Most people don't even think inside the box.

Re:Sounds about right. Root Cause Ignored. by pwizard2 · 2008-04-17 16:04 · Score: 1

I don't like to blame the victim but who clicks a link in an email? Really.

More people than you think. Many of them aren't sophisticated enough to look at the URL of the site they are about to visit and notice the absence of the proper domain. Something like http://95.32.56.224/to/be/or/not/to/be/sucker.html (example, not an actual link) definitely isn't Paypal, but they don't figure that out until their browser (hopefully) sends up the phishing flag.

--
"It is a denial of justice not to stretch out a helping hand to the fallen; that is the common right of humanity."

Re:Sounds about right. Root Cause Ignored. by chaoticgeek · 2008-04-17 16:05 · Score: 1

...Either the EWeek author or PayPal is clearly clueless because they used the words "safe" and "IE" in the same sentence... I think that I should fix that, Safe and any form of connection to the internet should not go hand in hand. Maybe Safer or more safe than other ways but it is never safe in general.

--
hello

Only dumb people... by wshwe · 2008-04-17 16:08 · Score: 1

Only dumb people require browsers with anti-phishing protection to save them from themselves.

It's a plot... by shmlco · 2008-04-17 16:10 · Score: 2, Insightful

"... so their little green bandaid is not going to fix anything."

I always thought this was a plot cooked up by VeriSign and Microsoft anyway. IE gets a cute little green bar that looks like it means something, and VeriSign charges four times as much money for the same certificate.

--
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.

Re:It's a plot... by Bert64 · 2008-04-17 20:45 · Score: 4, Insightful

It is...
Not only does it make more money for verisign, but it also raises the bar for retailers so that smaller shops can't afford the same certificate, and thus look to be "less secure" than their larger competitors.

A green bar means nothing, what's really needed is for users to make a white list of the sites they use, then when they visit a scam site it will say "this is a new site you've never visited before" as opposed to "this is paypal, one of your frequently visited sites"... The browser can tell the difference between www.paypal.com and www.p4yp4l.scam.cn, it just needs to communicate that to the user in a sensible way. Users need educating too, i can't believe people are still stupid enough to try logging in to paypal when the url bar contains something completely different.
Also, it should be impossible to change the status bar (that shows where a link points when you hover over it) and mail clients should ALWAYS do something similar, hyperlinks in html can say one thing but point somewhere completely different, and html mail clients are a lot worse at telling that to the user than browsers.

--
http://spamdecoy.net - free throwaway anonymous email - avoid spam!

Re:Netcraft seems to have a slightly different tak by Anonymous Coward · 2008-04-17 16:21 · Score: 0

The latest Opera snapshot 9903 didn't succomb to the cross-site scripting vulnerability.

"Quick SSL" certs have no value by Animats · 2008-04-17 16:27 · Score: 1

At SiteTruth, we divide certificates into three categories, rather than the usual two:

"Extended Validation" certificates.
"Organization validated" certificates, which must have an L (location) field and must not have a domain name in the O (organization) field.
"Domain control only validated" or "Quick SSL" certificates, which say nothing about who's at the other end of the connection.

Browsers normally lump category 2 and 3 together. This is not a good thing.

Category 3 certs, the "Instant SSL" certs, have no value in identifying the business. A category 1 or 2 cert increases the site's SiteTruth legitimacy rating, since we have a third party which has vouched for the ownership of the site. A category 3 cert does not.

Browsers should make this distinction. You never want to enter a credit card number into a site that only has a class 3 cert. You have no idea where your money is going.

Re:"Quick SSL" certs have no value by LoadWB · 2008-04-17 16:47 · Score: 1

Browsers should make this distinction. You never want to enter a credit card number into a site that only has a class 3 cert. You have no idea where your money is going.
Perish the thought. You realize how much that would run up the operational costs of fly-by-night hosting services? They might just switch to self-signed certificates (those drive me nuts.)

I believe that helps to illustrate one of my points, that the creation of the "instant SSL" certificates and subsequent proliferation did dilute the value of an SSL certificate as an implement of secure identification. And lumping the second category in with the third then would definitely push the higher-end EV SSL agenda.
Re:"Quick SSL" certs have no value by Animats · 2008-04-17 17:24 · Score: 1

(On a stylistic note, would someone at Slashdot please fix the bogus CSS that makes ordered lists ("ol") appear without numbers? Thank you.)

Nicely done, sir (was Re: Yes) by itslifejimbutnotaswe · 2008-04-17 16:29 · Score: 1

... ; that the use of semicolons is ill-advised.
I take my hat off to you good sir, for sneaking in that nice little amusement.

Hmm, the site isn't working... by LazyBoy · 2008-04-17 16:33 · Score: 1

...let me try the link I got in that e-mail.

--

If Chaos Theory has taught us anything, it's that we must kill all the butterflies.

But fake PayPal pages dont enforce PayPals rules. by Kenja · 2008-04-17 16:44 · Score: 1

So how does this help? The emails sending people to fake PayPal pages will still work. For some reason, the people trying to steal your money dont follow the PayPal rules.

--

"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"

Hilarious by Anonymous Coward · 2008-04-17 16:44 · Score: 0

This is really cool. I wish I had five sockpuppets to shill my posts up and get me out of the karma hell I got myself into for trolling. So I can troll some more.

good! by n3r0.m4dski11z · 2008-04-17 16:54 · Score: 0

"Apple's Safari browser, which offers no anti-phishing protection and does not support the use of EV SSL certificates."

um, whoes fault is that exactly?

--
-

bullshit by nguy · 2008-04-17 16:56 · Score: 1

You have a "blame the victim" mentality. It's clearly the fault of the stabbing victim that he got stabbed. He should have jumped out of the way. It's willful helplessness, plain and simple.

That's the kind of emotional drivel that's being used to erode our civil liberties. Of course, the perpetrator is the guilty party, and the victim is the innocent party. But were discussing policy, not guilt, so that doesn't mean that we need to protect the victim. It isn't the government's function to protect everybody from anything that might happen to them.

In this case, it's PayPal, a company doing this to reduce their financial losses, which is their right. But it's also my right to say that they are stupid. I don't use anti-phishing technology because all those technologies themselves have serious problems, and they are completely unnecessary: for any important site, I just type the URL or use a bookmark.

Re:bullshit by rtechie · 2008-04-18 11:38 · Score: 1

Of course, the perpetrator is the guilty party, and the victim is the innocent party. But were discussing policy, not guilt, so that doesn't mean that we need to protect the victim. It isn't the government's function to protect everybody from anything that might happen to them. I STRONGLY disagree with this assertion. I believe the PRIMARY function of government, far more important than any other aspect, is to protect the public from crime and violence.

Again, I do not understand why some people consider computer crimes to be fundamentally different from other types of crime. You seem to be going farther and saying that even though you agree that phishing is morally wrong, you don't think it should be illegal because...? My guess that you think it shouldn't be illegal because enforcement is impractical. I disagree.
I don't use anti-phishing technology because all those technologies themselves have serious problems, and they are completely unnecessary: for any important site, I just type the URL or use a bookmark. So how do you protect yourself from DNS spoofing?
Re:bullshit by nguy · 2008-04-18 21:06 · Score: 1

I STRONGLY disagree with this assertion. I believe the PRIMARY function of government, far more important than any other aspect, is to protect the public from crime and violence.

Of course, that is the primary function. But it isn't a function that trumps civil liberties, due process, freedom of speech, freedom of association, or many other rights. Societies in which protection from crime and violence trumps these individual rights are totalitarian and undemocratic, and I will fight people like you trying to turn our society into such a police state.

In particular, you should not be able to limit my freedoms because I might hypothetically do something to you.

You seem to be going farther and saying that even though you agree that phishing is morally wrong, you don't think it should be illegal because...?

Where did I say anything like that? Phishing attempts are violations of trademark rights, that's what trademark law is there for. And successful phishing attempts are fraud. Except for possibly adjusting penalties on trademark enforcement, we don't need new laws to deal with on-line crime.

Again, I do not understand why some people consider computer crimes to be fundamentally different from other types of crime.

Yeah, indeed, it boggles the mind. Can you tell me why you take such a stupid position?

So how do you protect yourself from DNS spoofing?

I don't understand what you're asking. You have heard of SSL, haven't you? In addition, my bank uses additional security mechanisms that make phishing just not work. Most forms of DNS spoofing are OS or server-side issues; they are simply not my responsibility and are outside my control; all I have to worry about is that my OS and my browser do name lookups correctly, respect TTL, and use certificates correctly.
Re:bullshit by rtechie · 2008-04-21 11:40 · Score: 1

Of course, that is the primary function. But it isn't a function that trumps civil liberties, due process, freedom of speech, freedom of association, or many other rights. Societies in which protection from crime and violence trumps these individual rights are totalitarian and undemocratic, and I will fight people like you trying to turn our society into such a police state. Wanting to punish con artists and thieves makes me a totalitarian? Are you serious?

Besides, there ARE no societies that protect citizens from crime at the expense of civil rights because the purpose of removing those civil rights is not to reduce crime, but to crush dissent. Do you really think there is less crime (of any sort) in China or Russia? If it makes you feel better, this applies to the USA too. The USAPATRIOT Act (for example) has absolutely nothing to do with fighting "terrorism" and everything to do with crushing dissenting voices, like pro-Jihad voices.
In particular, you should not be able to limit my freedoms because I might hypothetically do something to you. If you ROB me then you haven't "hypothetically" done something, you have LITERALLY taken my money.
Except for possibly adjusting penalties on trademark enforcement, we don't need new laws to deal with on-line crime. There are also serious jurisdictional issues here. For example, Many phishers come from Russia. Russia refuses to extradite criminals to the US. Rather than go along with this, I think the US should just kidnap the criminals off the streets of Russia and transport them back for trial in the US. This is called "rendition" and is currently illegal. It's also currently illegal for US law enforcement to engage in counterattacks, I think they should be allowed to do this too.

And we also need more cops. The FBI cybercrimes unit isn't cutting it. I think we need an agency dedicated to cybercrime so the agents won't be diverted by "terrorism", drugs, "satanic ritual abuse", or the current political crime de jure.
You have heard of SSL, haven't you? You do know it's possible to spoof an SSL cert, right? We do it here all the time.

What's the point? by AnuradhaRatnaweera · 2008-04-17 17:02 · Score: 3, Insightful

There are four scenarios, assuming we agree to what "safe" is.

1. Visiting paypal using a safe browser
2. Visiting paypal using an unsafe browser
3. Visiting a pishing site using a safe browser
4. Visiting a pishing site using an unsafe browser

The immediate result is only affecting scenario 2, so there will be some loss of business.

In the long run, paypal expects users who hit the scenario 2 to switch to a safe browser. And paypal is big and important enough (whether we like it or not) for a reasonable number of users to do the switch.

What really will happen... by Jafafa+Hots · 2008-04-17 17:05 · Score: 2, Insightful

"Dear Paypal User. We're sorry to hear that the person you bought the kidney from on eBay mailed you a kidney bean instead and won't return your $10,000.

We regret to inform you that we will not be able to process your Paypal Buyer Protection claim for the money because we have determined that you are not using a "safe" browser - a violation of our terms.
This, despite the fact that your victimization had nothing to do with phishing and your account was not actually compromised.

Due to this violation and to protect Paypal internal security, we have locked your account (and will be keeping the other $20,000 you had in it.)

--
This space available.

in other news... by Anonymous Coward · 2008-04-17 17:07 · Score: 0

in other news, safe internet browsers plan to ban paypal from loading...

one time CC numbers by timmarhy · 2008-04-17 17:08 · Score: 1

That will be the end of CC fraud. putting one time tokens on bank transfers. that will end bank fraud, or cut way way down on it.

why hasn't the banking industry down this with their billions of dollars i hear you ask? because they aren't the ones paying for this, we are. until you make your politicians change this, we will continue to have scammers and phishers.

--
If you mod me down, I will become more powerful than you can imagine....

Re:one time CC numbers by Gobelet · 2008-04-17 19:06 · Score: 1

I don't know about elsewhere, but this exists in France already. It's called e-Carte Bleue. You have a program on your computer, you enter an amount of money, you press generate. It calls back your bank, asks for authorization and responds back with a one-time CC number. While it doesn't work absolutely everywhere, it's damn useful to test out stuff. It costs not much IIRC, I don't use it that much these days (I only buy from trusted sources)...

Of course, you cannot book tickets you have to retrieve at the station/airport with this, but it's the most convenient system I found yet.

Good news by Anonymous Coward · 2008-04-17 17:16 · Score: 0

I don't really care about Paypal, and unlike some of the other comments, they have every right to determine what is secure and what isn't. It's their business. The important thing is that this is GOOD NEWS because MAYBE then the 80% of the world still using shitty, old IE6 browser will be forced to upgrade. Unbelievably good good GOOD news.

I'm more worried about sending limits by GodfatherofSoul · 2008-04-17 17:17 · Score: 1

A while back I dropped the direct Paypal links to my checking account after years of never using it. I recently got an email after an eBay purchase about a new sending limit. Their solution? Re-add my bank account to Paypal. Why I need to have a middleman for online transactions is beyond me. I could care less about them profiting from sitting on my cash midstream. I'm guessing a lot of people are going to pressure Paypal to change this practice (I hope).

--
I swear to God...I swear to God! That is NOT how you treat your human!

well by GregNorc · 2008-04-17 17:20 · Score: 1

Why would anyone choose Safari over Firefox? (I'm being serious.)

Re:well by Tom9729 · 2008-04-17 19:01 · Score: 1

I'm not a Mac user, but probably for better integration with the OS, or simply because they just don't know better.
Re:well by mr100percent · 2008-04-17 21:28 · Score: 1

Well, on the Mac it's much faster and integrated with the OS. I believe the Windows version beats Firefox in benchmarks too. And it makes fonts look spiffy.
Re:well by Hitchcock_Blonde · 2008-04-17 21:28 · Score: 1

Because it sucks less.

--
Karma Schmarma

Stupid by 56ksucks · 2008-04-17 17:22 · Score: 3, Interesting

I use OpenDNS which will not resolve a phishing site. Also, Paypal is one to talk. Their own Paypal plugin for creating virtual debit card numbers detects their own site as a phishing site. There goes using paypal on my Wii.

--

---- "Excuse me. Where's the children's gun section?"

Re:Stupid by Ginger+Unicorn · 2008-04-18 00:58 · Score: 1

"I use OpenDNS which will not resolve a phishing site."
it won't resolve phishing sites that are registered in its blacklist. You are still vulnerable to those that aren't.
i use opendns, but i back that up with safer client software like firefox+adblock plus+noscript, pidgin and thunderbird. you can't rely on a single point of failure for security. the more layers you have, the less likely they are to all fail simultaneously. the final layer of course being your own wits, which despite my acute awareness of phishing and how it works, have failed me once on a fake ebay email.

--
(1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons

QuickSSL Certs have plenty of value by Anonymous Coward · 2008-04-17 17:28 · Score: 0

SSL certs never had any value as an implement of secure identification. Regarding them as that was misuse. The sole value of SSL certs is encryption. End of story.

Added to that nonsense is the idea that you normally know anything about the people you're doing business with. You don't. These EV certs are a supreme waste of money.

I give it a thumbs up by TheDeivix · 2008-04-17 18:06 · Score: 1

I give it a thumbs up, in the end it's all done with the interest of protecting the users.

Besides probably people don't know that their browsers are unsafe, in that case you would be making them a favor by informing them of this fact.

I wonder how come a company like Apple is not implementing features found in other free products in their own... are Apple's developers lazy?... maybe they're thinking: "why waste my time and resources in providing my clients with features they don't even know they could use and have never asked for?".

This is pretty bad for a company that actually gets most of it's money directly from the end users of their products and i applaud every time someone provides them with the bad publicity they deserve.

Re:I give it a thumbs up by dmgxmichael · 2008-04-18 02:42 · Score: 1

I give it thumbs up because the sooner IE 6 dies the sooner I can stop considering it and its screwed up CSS implementation when developing pages.

Solution is easy.... by rishistar · 2008-04-17 18:39 · Score: 1

Solution - Paypal themselves send out a scam email - anyone who responds to it has their account shut down.

--
Professor Karmadillo Songs of Science

EV Certs by beemishboy · 2008-04-17 18:44 · Score: 1

I think it's a bit convenient that they are against browsers that don't support EV Certs since those cost extra from companies like PayPal. So, it is in their financial interest to have all browsers support EV Certs.

Re:EV Certs by Kalriath · 2008-04-19 12:07 · Score: 1

PayPal doesn't sell certificates at all, EV or otherwise. Conspiracy shot down.

--
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".

Hah. But then you *must* use Javascript by Anonymous Coward · 2008-04-17 18:58 · Score: 0

Subject says it all. Have anti-phishing (i.e. use light curtains) but switch on javascript (leafe the front *and* the back door wide open. Bunch of idiots.

If they were really being consistent... by argent · 2008-04-17 19:14 · Score: 2, Insightful

If they were really being consistent, they would ban Internet Explorer first.

No matter what soi-disant "security features" Microsoft implements, the fundamental design of IE is inherently insecure, and it can not be made secure without making deep changes in the API that will cause Microsoft to lose too much face to go through with it.

Re:If they were really being consistent... by Kalriath · 2008-04-19 12:14 · Score: 1

Stop modding this sort of shit insightful. It's not, it's the same FUD you all accuse Microsoft of spewing. The "fundamental design" is no less secure than Firefox. The insecurity lies in how people use it (and, of course, configure it). Noone denies that IE does not have sane defaults - far from it (allow ActiveX in the internet zone?!? Keep that to trusted sites thanks!). But the underlying design is not by its nature insecure.

Unrelated note, why does the Firefox spell checker insist that "Firefox" is not a real word?

--
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Re:If they were really being consistent... by argent · 2008-04-20 01:06 · Score: 1

The "fundamental design" is no less secure than Firefox.

Sure it is. Internet Explorer's fundamental security model is based on the assumption that it is possible to distinguish between whether data is trusted or untrusted depending on the location of the data, by making the HTML control responsible for deciding whether to allow a potentially untrusted object to run with local user privileges based on a heuristic model of "security zones".

This is not actually possible. Microsoft has been refining the model for over 10 years now, and it still hasn't managed to do it. No other browser or mail reader that I have used or supported (in 20 years of network administration experience) does this, and I was absolutely flabbergasted when not only did Microsoft not go "oops, we better change that" by the end of 1997 but actually took the company to the brink of being broken up to avoid having to change it.

It is not only incomprehensible to me how they came up with this, but it is also incomprehensible that anyone capable of coherent thought can defend it. Before 1997 the idea that anyone would write a program that would run potentially untrusted code outside as hard a sandbox as they could build was a joke. It was bad science fiction. What confusion in the mind would lead anyone to believe it's a good idea?
Re:If they were really being consistent... by Kalriath · 2008-04-20 08:43 · Score: 1

How about the fact that you are flat out wrong? Not on are the contents of the zones (with the exception of local computer) controlled by the user, but the level of trust assigned to each zone are user controlled too (as in, I can pop into Internet Options and disable ActiveX for any zone, or Javascript for any zone, and so on). It's really not a heuristic at all. It's "automatically assume that all sites run at the same level unless told otherwise". That's not exactly secure either, but Firefox does the same thing! In fact, the only browser on the Windows platform that actually does run in a Sandbox is... wait for it... Internet Explorer!*

*Vista required for sandbox functionality.

--
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Re:If they were really being consistent... by argent · 2008-04-20 11:02 · Score: 1

Not on are the contents of the zones (with the exception of local computer) controlled by the user, but the level of trust assigned to each zone are user controlled too (as in, I can pop into Internet Options and disable ActiveX for any zone, or Javascript for any zone, and so on).

This is true but irrelevant:

1. The worst problem with these zones is the "local computer" one, and that one is continually updated and changed as they discover more places that files on the local computer were actually placed there under the control of untrusted sites... by, for an early example, having the site pass URIs that point at cached copies of downloaded executables.

2. I spent 20 years as a system and network administrator and was able to successfully shepherd our division through some of the worst years of the virus plague that started in the late '90s... and I would be hesitant to try and come up with a set of security zone rules that was secure enough for my prefernces and that didn't cause the end user unacceptable levels of inconvenience... and that's just for the local zone! Expecting the end user to understand the consequences of changing these rules is expecting Uncle Elmer to be a "rocket scientist".

Firefox does the same thing!

Firefox doesn't even have a mechanism to let sites request dynamically loaded plugins run in the "local zone". The only thing that Firefox does that is even vaguely similar is the XPI installation mechanism...which is like a grotesque and unnecessary parody of security zones, and I have posted articles arguing against it in the past. Luckily it is an exceptional situation, and it makes it clear that it is an exceptional situation. It is still the wrong approach.

the only browser on the Windows platform that actually does run in a Sandbox

Running an inherently insecure browser in an inherently leaky sandbox is not an acceptable alternative to making the browser inherently secure in the first place. All it means is that when IE gets compromised, the attacker then has to come up with a second exploit or satisfy himself with running a botnet node for the duration of the current session, or stealing your bank account details by invisibly directing you to a phishing site instead of running a keylogger. Everything that Paypal (remember Paypal? That's who this song is about) is concerned about is still just as exposed as if that sandbox wasn't there.

Browsers 'with' anti-phishing protection.. by skinfitz · 2008-04-17 19:32 · Score: 1

...or browsers that have anti-phishing protection turned on?

Anti-phishing protection in Firefox basically reports every site you access to google. No Thanks.

Re:Browsers 'with' anti-phishing protection.. by Kalriath · 2008-04-19 12:09 · Score: 1

Unless you choose the option "Check using a downloaded list of suspicious sites" rather than "Check by asking [Google] about each site I visit"

--
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".

Title is wrong by Fuzzums · 2008-04-17 19:39 · Score: 1

It should be "Paypal plans to allow Lynx only"...

--
Privacy is terrorism.

Paypal invites Phishing by jrumney · 2008-04-17 19:56 · Score: 1

If Paypal is really concerned about phishing, why do they still send out emails saying their Terms and Conditions have changed please log in to your paypal account (link helpfully provided) to view the changes? Why do I need to log in to see the Terms and Conditions anyway? What if I want to see them before creating an account?

Re:Paypal invites Phishing by jskline · 2008-04-18 06:06 · Score: 1

Having seen these myself, you must still be on guard with these as they even may be phish's and you'd be logging into a proxy which is capturing keystrokes. I seem to remember seeing the email then not using the link, but instead opening the browser (Firefox) and www.paypal.com and go from there. Your http will be changed to https, etc., and you should be in the clear.

--
All content in this message is copyright (c) 2008. All rights reserved. RIAA is prohibited here.

man-in-the-middle agrees by Anonymous Coward · 2008-04-17 19:58 · Score: 0

While surfing around, it's likely you encountered some websites trying to install some malware. This malware will kick-in when you are entering paypal.com, your-bank.com etc. in your browser and instead of opening the requested login-page you are diverted to a fraudulent page looking exactly the same. You start entering your password, secureID etc. and get any plausible error message like service is down at the moment. Meanwhile, all your data is sent to the attacker who already logged into your 'safe' account and is making some transfers. At the same time, you are surfing to slashdot complaining about companies trying to protect your assets.

Re:man-in-the-middle agrees by prxp · 2008-04-18 04:54 · Score: 1

Good luck trying to accomplish all of that in less than 30 seconds. Also, phishers don't usually exploit compromised accounts in real time like you've described (and a paypal account would be a lot trickier to exploit this way). Any way, how is that scenario not applicable to any web browser as oposed to just a few "insecure" ones, like safari?

Just correcting you... by N+Monkey · 2008-04-17 20:05 · Score: 1

Nor vote either or get^h^h^hsell a mortgage it seems. :) There. That's better

Re:Just correcting you... by AvitarX · 2008-04-18 01:17 · Score: 1

The mortgage sellers did pretty well.

It is the mortgage buyers that suffer.

--
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg

OK so far so good by commodoresloat · 2008-04-17 20:11 · Score: 2, Funny

But I'm stuck at the end. Where's the "Suck it" menu?

Dear paypal, by Anonymous Coward · 2008-04-17 20:16 · Score: 0

I disable phishing protection in the browsers I use which do support it. I also disable javascript because I consider it a security risk; the majority of browser vulnerabilities require javascript be enabled. Paypal does work without script but makes some stuff difficult, encouraging your customers to run their browsers in a less secure mode.

So which is it, are you concerned about security or not?

Safari? by Anonymous Coward · 2008-04-17 20:34 · Score: 0

If they ban the default browser on the 2nd most popular desktop OS in the market they will lose hundreds of thousands of users and buyers will go elsewhere....maybe a good thing then, especially with their anti-competitive PayPal association actions lately!

Open letter to PayPal by SanityInAnarchy · 2008-04-17 21:00 · Score: 3, Interesting

I realize I'm a little late in the game for this, and I give myself 50/50 odds that I'll actually send it in, but here goes:

I use PayPal right now because it is one of the more secure options out there. I give my financial details to one party (PayPal) instead of every site I do business with -- which means PayPal gives me the opportunity to review every single transaction, and approve or deny.

It's also nice and reassuring to visit www.paypal.com, and see an https URL the whole way through -- knowing nothing important is ever transmitted in the clear.

And for some small amount of money -- I forget exactly how much it is, but relatively cheap -- I can even get a physical security token, which, I believe, is also valid with VeriSign. And due to its implementation, this token requires no additional software -- I just read a number off the token and into a browser window. What's not to like?

These are the reasons a highly technical and security-conscious person might want to use PayPal. Highly secure, with a lot of control and choice.

Now, I can understand wanting to protect the less-technical users. Send them emails every now and then, telling them not to click links in emails. Warn them if they're not using a secure browser. Provide technical support, walkthroughs, and as much hand-holding as you like.

But please don't alienate those of us who know what we are doing by removing our choice. Don't block browsers simply for not supporting anti-phishing, or having it disabled -- some of us know how to read the address bar, and value our privacy. Block older, actually vulnerable browsers if you must, but do not make it a whitelist.

The day I have to turn on user-agent spoofing to get to my money is the day I take my money somewhere else.

--
Don't thank God, thank a doctor!

Re:Open letter to PayPal by oliverthered · 2008-04-17 23:38 · Score: 1

1: Install a botnet client on your machine.
2: Install a CA Certificate on your machine
3: Make paypals address point to the ip of a proxy machine with a certificate for paypal on it that's signed with the CA I've just installed.
4: wait for you to type in the valid paypal address that's now going through my proxy.
5: profit.

--
thank God the internet isn't a human right.
Re:Open letter to PayPal by SanityInAnarchy · 2008-04-18 14:15 · Score: 1

I think you forgot the ??? before step 1. How did you get access to my machine?

Also: By the time you have the ability to install a CA Certificate on my machine -- which requires root access, by the way -- you have already completely pwned me. At this point, anti-phishing in the browser is just going to slow you down -- what's to stop you from silently disabling the anti-phishing capability?

For those of us who do know how to read a URL -- both the domain name and the https part -- anti-phishing protection is pretty much completely superfluous. If Paypal is seriously going to implement pro-anti-phishing measures, it's as likely that I'll be running a proxy of my own -- right up until I move away from PayPal.

--
Don't thank God, thank a doctor!
Re:Open letter to PayPal by Anonymous Coward · 2008-04-20 21:49 · Score: 0

. If Paypal is seriously going to implement pro-anti-phishing measures, it's as likely that I'll be running a proxy of my own
... and do what exactly with CONNECT requests?

This is the point of the step (2) in the comment you replied to. MITM on SSLv3/TLS1 is actually pretty difficult without subverting the stockpile of known CA public keys (or any process that updates that stockpile) or exploiting a client that does not actually validate the whole certificate chain (which is amazingly common).

SSLv2 subversion (and MITM) is much easier, and many clients and servers cooperate with SSLv2 attackers. However, it is easier still to attack infrastructure other than the transport layer security mechanisms; why wouldn't step (2) involve a keylogger that fires off results encoded in DNS queries?
Re:Open letter to PayPal by SanityInAnarchy · 2008-04-21 13:31 · Score: 1

MITM... is actually pretty difficult

What makes you think I'll be connecting to my proxy as https://www.paypal.com?

It's not difficult to write an https client. It's marginally difficult to intercept all link URLs and replace them -- only really difficult because JavaScript may be involved, and it may be possible to simply filter JavaScript.

Regardless, I'll probably deal with it in a much simpler way: User-Agent spoofing till I can transfer my funds to people who don't discriminate by OS and browser.

--
Don't thank God, thank a doctor!
Re:Open letter to PayPal by Anonymous Coward · 2008-04-22 10:04 · Score: 0

https is an end to end method; when you insert a proxy you end up following RFC 2817 s5.2 succ.

It is only "not difficult" to write an https client if you leverage pre existing software such as openssl. It is very easy to write a broken TLS implementation.

The TLS tunnel built end to end, with possible CONNECT-accepting proxies in the middle, is the transport layer for the HTTP byte stream. Many HTTP-talking clients can change their User Agent field on their own and this affects https URIs constructed by the client (and showing the relevant padlock/colour change). A third party proxy can only manipulate the contents of an HTTP-over-TLS connection if it terminates the TLS tunnel, which it can only do if the initiating client accepts the proxy's certificate as the end point. This suggests either no certificate-to-FQDN matching at all, or a trusted wildcard certificate on the proxy. The downside in both cases is that client loses all information about the proxy's counterparty, even if the proxy is fully trusted:

browser--->TLS-terminating-proxy--->website

The browser only sees the certificate and encryption offers made by the TLS-terminating-proxy. This is deliberate and very very hard to work around, because the TLS-terminating-proxy is an MITM reading and mutating end to end traffic.

browser--->CONNECT-tunneling-proxy--->website

The only thing the proxy in this model sees is the CONNECT request and the cryptotext exchanged between the browser
and the website. It is (probably) computationally infeasible for the proxy to read or alter the plaintext.

The important thing here is that the browser knows that it is talking to the website because of PKI in the form of the X.509 certificate which has a CN (or equivalent) with the website's FQDN in it, which in turn is signed by a chain back to the private key of a CA whose public key is already known to the browser.

Spoofing that chain is computationally infeasible, although server configuration errors involving long cert chains are so distressingly common that e.g. Verisign's relatively short lived Class 3 intermediate keys are shipped with many browsers, and are a possible vulnerability if you want to explore your option of a TLS-terminating proxy that does not set off your browser's alarm bells.

FYI, you might want to read http://www.privoxy.org/faq/misc.html#AEN899 which deals with this issue from the perspective of an aggressive (and extremely useful! i love it!) proxy that among other things obsecures User-Agent information. http://www.privoxy.org/user-manual/actions-file.html#LIMIT-CONNECT also goes into this in some detail.

If you want you can repeat a simple experiment and try to log in to paypal without using an https URI, either by using an https->http URL rewriting shim or by simply blocking outbound connections to port 443. Paypal to its credit makes these approaches fail.
Re:Open letter to PayPal by SanityInAnarchy · 2008-04-22 14:34 · Score: 1

https is an end to end method

One of the endpoints is my proxy. My browser wouldn't be talking https -- the proxy would be in the other room. In the event that I'm not home, I can VPN in, or use https to the proxy -- at a different URL.

It is only "not difficult" to write an https client if you leverage pre existing software such as openssl.

Which I'd naturally be doing. Probably without realizing it -- I'd just grab a decent http client library in the language of my choice.

The downside in both cases is that client loses all information about the proxy's counterparty, even if the proxy is fully trusted

Unless the proxy itself knows about its counterparty, if that word means what I think it means. And yes, the proxy would be fully trusted.

Spoofing that chain is computationally infeasible

Who said anything about spoofing the chain? This isn't meant to be transparent to the client, only the server.

Let me try to make this clear with my own ASCII chart:

browser ---> https://mydomain.com/proxy/www.paypal.com ---> s/Foo: .*/Foo: Bar/ ---> https://www.paypal.com/ browser <--- https://mydomain.com/proxy/www.paypal.com <--- s/www.paypal.com/mydomain.com.../ <--- https://www.paypal.com/

Yes, totally insecure unless you trust that proxy, and you trust it to verify www.paypal.com, or present some sort of an interface for you to verify it yourself -- a web/GUI interface, not some trick with https.

Utterly pointless, of course, as every browser I've used lately has some sort of user-agent spoofing, but it may be needed if PayPal uses more than the user-agent. But still pointless, as PayPal has apparently claimed they won't block browsers.

--
Don't thank God, thank a doctor!
Re:Open letter to PayPal by Anonymous Coward · 2008-04-23 13:10 · Score: 0

I kind-of thought that was the direction you were heading in, and was writing something along those lines yesterday (my time) but the start of my reply got lost because the new reply system will close edit boxes (destroying the text in them) if not careful, and I wasn't careful...

Since we are now in the realm of a thinking experiment, let me suggest that your approach will build all the non-front-end parts of your browser, since you have to prevent "leaks" of https URIs back to your (third party) browser, which would then act on them and probably result in waving warning flags or displaying surprising results. This is best observed through the HTML you get across connections to e.g. www.mac.com port 443. WebObjects juggles URI types in ways that are hard to "fight" with a https-to-http URI rewriting proxy. Several other backend systems will require your proxy to examine and dynamic scripts (ECMAScript for example) in order to prevent your "terminal" (displaying) browser from thinking it should connect to someone else's port 443.

You could alternatively use packet filter/forward systems, or DNS resolver tricks to make your "terminal" browser move *everything* through your proxy, but this approach requires a wildcard TLS certificate that your browser trusts.

The latter approach is effectively the same as trusting an ISP's (or hotel's... or corporate's...) intercepting proxy, and there is proof-by-existence that this is workable. SOCKS proxies are somewhat similar.

The former approach is analogous to the browser/GUI split among WebCore, WebKit and Safari, or WebCore, WebKit and OmniWeb (for example). The backend processing of fetching hypertext is decoupled from rendering and from the user-facing control plane. You could attack your problem in the front end by producing your own control plane (there are several open source starting points like http://webkit.org/ ) or in the back end, along the lines you are suggesting. There are trade-offs either way.

"PayPal has apparently claimed they won't block browsers" to me reads that PayPal realizes that blocking browsers is very hard to do, since there are few reliable ways to identify browsers other than via what they volunteer in requests, and most of those ways are disgustingly non-portable among the set of "secure" browsers they like. Apple's "solution" in the iTMS is to use its own markup language and transport that looks a lot like HTML but isn't really, and is designed to be non-interoperable with clients other than iTunes (in principle they could require the client to do unpublished algorithmic mutations as part of a three-way handshake, for example, which is also the approach taken by some sites to identify the capabilities of ordinary web browsers for actual interoperability reasons).

However, back to the original point, the key to solving interoperability problems created by "dumb" management decisions at popular web sites is to get a decent coder familiar with (and able to change) the guts of a browser to suffer the same problem enough that he or she codes a workaround and makes it available to you (and others).

On the other hand, if you really can write your own middleware proxy, especially if it is of general use rather than for solving one specific transient "dumb" management problem (i.e., PayPal's original announcement), then publish and share it!

Re:Sounds about right. Root Cause Ignored. by grahamm · 2008-04-17 21:26 · Score: 1

It is not just email. A lot of web pages have a 'pay me by paypal' button. I am sure that it is possible for a dishonest web author to link to a phishing site instead of the real paypal.

Fuck Fishhing filters by 1001011010110101 · 2008-04-17 22:25 · Score: 1

Im not going to send some server every URL Im visiting, no fucking way. I don't care their privacy policy (that can change at any time). Im specially not sending them to MS, or Google so they can cross reference it with my search results and mails. Its OK if they need some particular type of certificate support, but Im not giving up my privacy because some retards click on any URL. In any case, Im not using Paypal either, but I hope nobody follows suit on this.

Death of IE6? by Anonymous Coward · 2008-04-17 22:42 · Score: 0

What happens if the browser is using a 3rd party tool bar that offers phishing protection? Does this system only detect if the protection is built into the browser itself?

If it is only detecting built in protection perhaps this will encourage IE6 to die! Anything speeding up IE6's death is MORE than welcome by every developer and designer on the internet.

PayPal cannot be trusted by Anonymous Coward · 2008-04-17 22:54 · Score: 0

Unfortunately I have had many bad experiences with PayPal. They are a brick wall when it comes to disputes. I have had to have my bank cancel cc transactions because of their intransigence.

Lets hope that the banks gang up to put PayPal out of business some day. What are they waiting for?

Hmmm. by PigleT · 2008-04-17 23:09 · Score: 1

Ah crap, there's a whole load of angles on this.

a) it's not a matter for Paypal to "support" browsers, but rather, this being the web, for them to write according to standards and let browsers display their site how they will, etc...

b) if they cannot trust me to use my own choice of browser (currently epiphany) correctly and put an error-message in front of me, they will not get my custom. I only use sites who want me to use them.

c) Right when I was getting all interested in them because of the convenience, too...

d) of course it's no real security at all. How will they know what the browser is? User-agents are so fakeable it would be beyond preposterous; javascript can be disabled (and if they refuse to work without js, that raises whole questions about accessibility)

e) what about the effects on people using paypal for "donate" buttons on their sites - do they deserve the subsequent drop in income *and* ill-will this will engender?

Someone remind me who the alternativs are for sending money back & forth...

--
~Tim
--
.|` Clouds cross the black moonlight,
Rushing on down to the circle of the turn

Technically inclined user defeats barrier to... by patio11 · 2008-04-17 23:33 · Score: 3, Funny

... giving Paypal money. Wow, right on brother. Sock it to the man.

--
Help poke pirates in the eyepatch, arr.

Serious Safari Question by dreamchaser · 2008-04-17 23:39 · Score: 1

Does anyone actually like or use it? I know the first thing I do on a new Mac is download Firefox and Camino. I am not sure whey but I've always found Safari to be annoying for some reasons. Perhaps it's just me.

Re:Serious Safari Question by OS24Ever · 2008-04-18 00:18 · Score: 1

Must be just you, I've used safari since it was in early wide beta and available years ago. other than not being fond of the name I've never had an issue with it. Then again i just use it to browse the internet.

--
As a rock-in-roll Physicist once said, No matter where you go, there you are.
Re:Serious Safari Question by yabos · 2008-04-18 10:43 · Score: 1

I use it every day including now. Firefox 3 Beta still looks a little out of place even with all the improvements they've made. The text always looks different that Safari and it's enough that I find it annoying.

I ban PayPal by gelfling · 2008-04-17 23:51 · Score: 1

Because it's a criminal enterprise.

Firefox also works on NT 3.51, BTW by Anonymous Coward · 2008-04-18 00:56 · Score: 1, Informative

Windows NT 3.51 is technically older than Windows 95, so you can go that far back if you want. The problem will be for Windows 3.x users, though, and yes there still are some out there on the WWW (including myself on occasion.) However, I never trust the web for anything financial anyway, due to exploits I find on my own, so I'm not impacted anyway. :)

good move by hesaigo999ca · 2008-04-18 01:12 · Score: 1

Finally taking some of the blame for the problems out there, good for you!

HEY PAYPAL! Stop allowing Hotlinking! by microcars · 2008-04-18 01:54 · Score: 1

Can someone explain to me why PayPal decides a browser is "unsafe" when they still allow their IMAGES to be hotlinked by any remote host?

Every phishing scam I have ever seen that looks like a valid PayPal page also has all the image files HOSTED BY PAYPAL (which of course saves bandwidth charges for the scam site)

I just tested this a minute ago and I was able to easily replicate the PayPal Login Page on one my sites with PayPal still hosting all the image files.

If PayPal is serious about stopping Phishing maybe they could start by dis-abling HOTLINKING their files?
I don't know, maybe I am asking too much.

--
I like microcars

Maybe banks need a Nick Burns? by Orion+Blastar · 2008-04-18 02:12 · Score: 1

Your company's computer guy?

"You're doing it wrong, moooooove!" Then he sits down and fixes it. :)

--
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.

Totally mod parent up by EMeta · 2008-04-18 03:24 · Score: 1

I had no idea this happened. Thanks!

The Phishing Scammer Wont Block Those Browsers by NerdENerd · 2008-04-18 03:51 · Score: 1

So they get blocked if visiting the real site but not when they click the scammers link. Seems like a useless plan to me.

re: But IQ tests filter PayPal, don't they? by King_TJ · 2008-04-18 04:15 · Score: 2, Informative

Considering the plan for eBay to start REQUIRING PayPal as the only form of payment for auctions, PayPal's notorious habits of freezing people's accounts unfairly and improperly, and now, their intentions of banning popular web browsers just because they don't include dubious "anti-phishing" technologies in them ... I'd say the INTELLIGENT thing to do is give PayPal the boot!

I did... Google Checkout works fine for me as an alternate way to accept credit card payments from people, and seems to cost a little less too.

So thats it for IE then by ibm1130 · 2008-04-18 04:34 · Score: 1

Winders and the Exploder are security incidents waiting to happen so I guess that means PayPal users so equipped will be SOL.

EV certificates don't really seem to help by pluggo · 2008-04-18 05:25 · Score: 1

From Wikipedia's Big Book of Things That Might Not Be True (by the Internet):

There has been some concern that EV certificates, despite their improved authentication and higher cost, will not prevent phishing attacks[9].
In 2006, researchers at Stanford University and Microsoft conducted a usability study[10] of the EV display in Internet Explorer 7. The study measured users' ability to distinguish real sites from fraudulent sites when presented with various kinds of phishing attacks, and found that there was no significant difference between users who saw extended validation indicators and those who did not. Users who received training with the Internet Explorer 7 help file were more likely to judge all sites legitimate, regardless of whether they were fraudulent.

9 = http://www.schneier.com/blog/archives/2006/12/microsoft_antip.html
10 = http://www.usablesecurity.org/papers/jackson.pdf

--
Pulling together is the aim of despotism and tyranny. Free men pull in all kinds of directions. It's the only way to mak

Re:Sounds about right. Root Cause Ignored. by Bob-taro · 2008-04-18 06:07 · Score: 1

It is not just email. A lot of web pages have a 'pay me by paypal' button. I am sure that it is possible for a dishonest web author to link to a phishing site instead of the real paypal.

In that case, the blocking wouldn't help, because the fake paypal wouldn't block.

--
Prov 9:8 Do not rebuke mockers or they will hate you; rebuke the wise and they will love you.

Whys by porneL · 2008-04-18 07:15 · Score: 1

but, what about my shoes! by Anonymous Coward · 2008-04-18 08:06 · Score: 0

Most of the places I buy my shoes at online use Paypal! And I love Safari!!! I can't believe that Paypal has declared war on my shoes. I guess i will have to shop at non-paypal places. Just posted about Paypal's attack on my shoes http://webpoet.wordpress.com/2008/04/18/paypal-verses-my-new-summer-shoes/

Totally agree. by shmlco · 2008-04-18 09:45 · Score: 1

Totally agree. In fact, PayPal is probably making things worse by insinuating that if you're using IE and you have a little green bar then you're absolutely safe.

--
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.

OT for sure by Macthorpe · 2008-04-18 10:22 · Score: 1

That one's definitely twitter. I'm Macthorpe, and so's my wife! :D

--
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien

But Paypal.com isn't doing the phishing by Domo-Sun · 2008-04-18 13:20 · Score: 1

Wait a minute here. Paypal is going to block browsers? How does this stop phishing since the phishing is not occurring at paypal.com? I guess they want to attempt to get existing users accustomed to using a secure browser, but I'm sure phishermen will find a way around that too. As for me, I wouldn't change my browser permanently because one webpage fails in it, so I think this move is phishy.

Slashdot Mirror

PayPal Plans To Ban Unsafe Browsers

367 comments