Subject: Re: [Fwd: [isdf] need help from the ietf list...can someone post this for me? or allow me to post directly?]

From: [email-masked]
Date: Sun, 21 Dec 2003 20:05:02 -0500

On Sun, 21 Dec 2003 18:40:57 EST, Parry Aftab said:
> It's a spoof, phished e-mail. No such credit card. I just confirmed with
> the powers that be in PayPal/eBay. The scams are good enough to confuse
> even ietf members. See the problem? How can someone tell this was a
> phishing expedition?

Damned good one, they even got their URL into PayPal's FAQ:

https://www.paypal.com/cgi-bin/webscr?cmd=_help-ext&leafid=1782

Either this is a whole new level of phishing, or the left hand doesn't know
what the right hand is doing.  You tell me.

> We need some tech guidance?

Yes, PayPal apparently needs some. guidance in getting their info pages
to correspond to their policy - see the above URL, see the mail I quoted,
and then see this URL:

https://www.paypal.com/cgi-bin/webscr?cmd=_help-ext&leafid=56413

Also might want to have another chat with your powers that be, they
seem to be out of touch with what their company and their business
partners over at Providian are actually doing.

---

From: "Parry Aftab" <[email-masked]>
Date: Sun, 21 Dec 2003 20:36:40 -0500

Will resend this to them. For their review. Will get back to you.
Parry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Sunday, December 21, 2003 8:05 PM
To: Parry Aftab
Cc: 'Franck Martin'; [email-masked]
Subject: Re: [Fwd: [isdf] need help from the ietf list...can someone
post this for me? or allow me to post directly?] 

Either this is a whole new level of phishing, or the left hand doesn't
know
what the right hand is doing.  You tell me.

Yes, PayPal apparently needs some. guidance in getting their info pages
to correspond to their policy - see the above URL, see the mail I
quoted,
and then see this URL:

---

From: Mark Smith <[email-masked]>
Date: Mon, 22 Dec 2003 17:18:15 +1030

I've heard of one recently where the actual page was from the legitimate bank web site, but the dialog box window asking for username and password detail was the spoofed component. Everythink, including HTTPS locks, URLs etc displayed would have looked, and actually were legitimate.

---

From: "Parry Aftab" <[email-masked]>
Date: Tue, 23 Dec 2003 19:13:48 -0500

Thanks. I heard that this happened with earthlink, but haven't yet
confirmed it.
Parry

-----Original Message-----
From: Mark Smith
[mailto:[email-masked]] 
Sent: Monday, December 22, 2003 1:48 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Fwd: [isdf] need help from the ietf list...can someone
post this for me? or allow me to post directly?]

I've heard of one recently where the actual page was from the legitimate
bank web site, but the dialog box window asking for username and
password detail was the spoofed component. Everythink, including HTTPS
locks, URLs etc displayed would have looked, and actually were
legitimate. 

know
quoted,

---

From: Mark Smith <[email-masked]>
Date: Mon, 22 Dec 2003 17:18:15 +1030

---

From: jfcm <[email-masked]>
Date: Tue, 30 Dec 2003 05:59:29 +0100

It seems that only multi-channel synchronous banking level system using 
randomly called third party systems may be trustable. Good encryption 
protects data once both ends are authenticated, but does not warranty 
authentification.

The need is to make that type of service available to everyone. It seems 
that the cost is nearly acceptable today. To fight spam and to protect dns 
updates seems to be two realistic demands. We are working on that kind of 
solution for the AFRAC project. I am interested in who might want to 
discuss that topic towards real life plug and play solutions.
jfc