RE: Discovering and Stopping Phishing/Scam Attacks

[webcenter () sapo pt]

alex, i understand your point and agree, the education, the physical ID..

but all this process is just to slow the phisher atacks, and complicate there
work...

i know that maybe if we complicate the work to phisher atacks, maybe pharming
will apear more, and i know that pharming atacks is more dangerous then
phishing atacks... so is impossible to turn internet secure with just one login
system but if we can make it more secure why not?? you talk about spoofing email
accounts, but i think that is not the real "phishing" problem...

regards
Nuno Costa


Alex :

Dude,

Under your scheme, Phishers would only need to spoof an "unblock"
email to
the user.

How many users are actually going to invent a NEW password and a NEW
3rd
item? They are just going to re-enter their current ones and give
these to
the Phisher.

Most people don't even bother making unique passwords for each
service.

It's still not clear what the utility of the 3rd field is -- seems
equivalent to a longer password.

-

I think a better way to stop phishing is simple education. People are
used
to verifying physical ID (i.e. Driver's license) for many types of
transactions (bank, apartment lease, etc). They need to get used to
verifying SSL certificates for login webpages.

-Alex

> ok mr. moderator...
>
> i think the real problem to phishing exists is the weak process of
login
> systems
> today...
>
> anyone just needs a login and password, to be authenticated, i
think web
> aplications needs to change login systems... to be more tight...
and the
> phishers maybe loose there hope to grep information very easy with
just a
> username and password...
>
> my idea and solution to a new login system is this...
>
> creating a 3rd field, this 3rd field the user will choose... it
will work
> like
> saying yes this is the real bank system welcome back mr. user
insert your
> password...
>
> the process...
>
> 1rst page
> user -> puts the username...
>
> second page..
>
> 3rd field -> what is your cat name? now the user knows that this
was the
> question that he have put int the 3rdfield from the real bank site
(he can
> put
> what he want)...
> password ?? -> user puts the password.. he is athenticated.
>
> now the phishers they have more work, needs two process to gain
access to
> the
> bank user account...
>
> first they need to colect the username to get the 3rd field... and
they
> need to
> put the 3rdfield in the false website... to get the password... but
this
> is the
> deal...
>
> when a user or anyone, puts the username in this login system needs
to
> proceed
> with a password, if not, if the user close the browser, if he tries
3times
> and
> can't login, the system will block the username and send a email to
the
> real
> user, a code to unblock the username and force the user to change
the
> username
> and 3rd field... and now the phishers don't know again what will be
the
> new
> username and 3rdfield...
>
> this system, is nothing from other planet and i think that help a
lot the
> users,
> and will stop a litle or a big % this phisher mans...
>
>
> regards
> Nuno Costa

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks
from
CORE IMPACT.
Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------





SMS GRÁTIS do seu PC para qualquer rede nacional (TMN, Vodafone, Optimus e PTC). Basta instalar o SAPO Messenger e 
adicionar amigos!
Vá agora a : http://messenger.sapo.pt/sms/


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------