Phishing is becoming an increasingly big problem on the net. For those of you who are not familiar with the term, Wikipedia defines it as:
In computing, phishing is a form of social engineering, characterized by attempts to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business in an apparently official electronic communication, such as an email or an instant message.
When the end user receives an email that for all purposes appears genuine and appears to originate from a trusted source, the psychological effect is to lower the levels of suspicion the user would normally have, when asked to provide sensitive information.
There really is very little we can do to stop Phishers from making carbon copies of websites, spoofing email addresses and even buying ssl certificates to make their site appear more genuine.
The underlying problem here is the way authentication is performed on the internet. When we are dealing with financial services such as internet banking, we currently have a one-way authentication process - the customer is required to prove to the internet site, that she is the legitimate owner of a bank account. This authentication is normally performed through providing a password and perhaps a date of birth.
However, this is really only half the story...
Let us consider an analogous situation in real life. The bank's customer decides she would like to withdraw some cash from her bank. So she visits the branch, identifies herself with a driving license, provides her account details and is successfully served by the branch.
She feels perfectly safe because she knows the bank's branch is genuine and the people working there are to be trusted.
The act of "phishing" does not exist when making physical financial transactions by visiting your bank's branch. Why? Because the economic cost of setting up a fake branch of a bank, employing fake staff is too high, and the risk of being arrested by the police is also very high.
The big problem is that on the internet, the economic cost and risk factors are very low. Any skilled web developer could setup a fake site in a matter of days.
We therefore need a mechanism by which the bank's customer can be assured that the website she is visiting is genuine, and is not being redirected to a phishing site.
This mechanism is very simple: two way authentication. As part of the login process to all internet banks, once the customer has provided part of their password (e.g. 1st, 3rd and last character), the bank's site will provide the customer with a "fact" about them (e.g. your cat is called Garfield). If this information is incorrect or is not provided, the customer knows that the internet site is not genuine and can immmediately terminate the login process, thus safeguarding their account information.
A detailed example of this login process could be formed using two passwords and a "fact" about the user:
1) Bank requests internet banking ID and first password;
2) If first password is correct, bank provide key "fact" to user (e.g. your cat is called garfield).
3) User checks if the "fact" is correct and either leaves the site if it is wrong / missing. If it is ok, then the user clicks proceed.
4) Bank asks for second password, if correct then authentication is complete.
If all financial institutions adopted this login procedure, phishing could be eliminated within the banking sector.
14/02/06 @ 07:12