Subject: Re: [saag] [websec] [apps-discuss] [kitten] HTTP authentication: the next generation

From: Ben Laurie <[email-masked]>
Date: Fri, 14 Jan 2011 10:00:18 +0000

On 14 January 2011 02:24, Peter Gutmann <[email-masked]> wrote:
> Marsh Ray <[email-masked]> writes:
>
>>Phishing can be said to have been prevented only when the user can be relied
>>upon to refuse to enter his password into an insecure box.
>
> I think you need to phrase that more generally, "when the user can be relied
> upon to not authenticate to the wrong site", because there's more ways of
> authenticating around than just typing a string into a web form.  For example
> some password managers do site-specifc passwords, so even if you go to the
> wrong site you can't accidentally provide your credentials for the correct
> site.

That phrasing is only correct if the authentication method leaks the password...

>
>>For example, my bank asks for my username and then shows me a familiar
>>picture (e.g., a rocking horse) that is supposed to prevent phishing. This
>>stops phishing only in the sense that it requires the attacker to use a CGI
>>proxy app rather than simple static phishing site.
>
> ... or display a broken-image GIF, or a message that the award-winning
> security whatsit is being upgraded and will be back soon, or ...
>
> (this is from a real-world evaluation of the (in-)effectiveness of site
> images, I can dig up the ref if required).  Site images rate more as a
> security gimmick than any real security measure.

Exactly.

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 26 Jan 2011 12:47:59 +1100

While this thread is doubtless interesting to those on the various lists in the CC line, it's getting a bit verbose. 

Perhaps discussion could be consolidated on the [email-masked] list?

Regards,

--
Mark Nottingham   http://www.mnot.net/