Cryptology ePrint Archive: Report 2004/155, revised 7 Nov 2004

In spite of the use of standard web security measures (SSL/TLS), users often fail to detect `spoofed` web forms, and enter into them sensitive information such as passwords. Furthermore, users often access the spoofed sites by following a link sent to them in a (fraudulent) e-mail message; this is called `phishing`. Web spoofing and phishing attacks cause substantial damages to individuals and corporations. We analyze these attacks, and identify that most of them exploit the fact that users are not sufficiently aware of the secure site identification mechanisms in browsers. In fact, it appears that even web designers are often confused about the need to securely identify login forms; we show several sites that prompt users for passwords using unprotected forms.

We derive several secure user interface principles, and present TrustBar, a secure user interface add-on to browsers. For protected web pages, TrustBar identifies the site and the certificate authority, using logos or at least names (rather than URL). For unprotected pages, TrustBar displays highly visible warnings. Early experimental results indicate that these mechanisms provide substantial protection, even for naïve and off-guard web users, from spoofing/phishing attacks

Download