Re: Phishing Links

["Flynn, Gary - flynngn" <flynngn () JMU EDU>]

But now all the phishers know what to include in their messages to you. :)

A signature that includes a link to a site with an SSL cert and that requires client cert authentication might do the 
trick assuming all the recipients have a client cert and people can be trained on what to expect when that verification 
site is clicked. (e.g. Certificate error vs password login screen)

Of course, the link doesn’t have to convince someone to provide passwords and bank account numbers to be effectively 
malicious. Some just want the recipient to click the link so whatever buggy, bloated document reader or media player 
that might be installed can be exploited.



On 7/7/10 4:34 PM, "Ben Woelk" <fbwis () RIT EDU> wrote:

We handled the authenticity of messages a little differently. We have a signature standard with required elements. In 
addition, any message that arrives with the term “password” gets a warning prepended to it.

Our signature standard is at http://security.rit.edu/signaturestd.html