RE: Article - A solution to phishing

["Damhuis Anton" <DamhuisA () aforbes co za>]

Hi group

I had a look at the passmark web site, and at first it really impressed me, but then got thinking, and currently am at 
the conclusion that it could still be spoofed by another web site.

A spoofed site could still retrieve the "real" information from the site that is spoofed, as and when the user enters 
information. Some of it would be (or could be) hit and miss, but would become gradually easier.

In a Windows environment I would use the MSXML2.ServerXMLHTTP Object to pass on the users information and get responses 
from the real server.

I liked the idea of the picture that the user knows, in the email and on the web site. But surly because the email is 
unsecured, (in transport and storage), the attacked could get the picture and thus display it on the spoofed web site 
for that user.

Possibly for now ,the  attacker would hopefully move to another site that would be easier to spoof then one secured by 
passmark.

Or am I missing something from the presentation?

Regards
  Anton

-----Original Message-----
From: Dave Jevans [mailto:djevans () teros com]
Sent: 30 November 2004 12:55
To: Michael Silk; webappsec () securityfocus com; mb () xato net
Subject: RE: Article - A solution to phishing

Imaged based mutual auth a la passmark can also authenticate the site to
the user.

Confidentiality Warning
=======================

The contents of this e-mail and any accompanying documentation
are confidential and any use thereof, in what ever form, by anyone
other than the addressee is strictly prohibited.