Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Microsoft Sponsors Antiphishing Bakeoff

kdawson posted more than 7 years ago | from the here-phishie-phishie dept.

94

uniquebydegrees writes, "InfoWorld is blogging about the (predictable) results of a Microsoft-sponsored antiphishing technology bakeoff. From the TechWatch blog: 'Microsoft's Phishing Filter (MPF) in IE 7 Beta 3 received the highest "composite score" at 172, followed closely by NetCraft's toolbar with a composite score of 168. But when you dig into the numbers, another story emerges... IE's MPF antiphishing toolbar doesn't top out any of the individual tests that make up the composite score... So how did MPF end up on top?... Microsoft didn't do the best job of spotting phish sites, but it did do the best job of blocking the ones it did spot, and blocking was what garnered the most points... Blocking a phishing Web site earned you twice as many points as just warning about it in this test, but is blocking really twice as effective as just warning users?'"

cancel ×

94 comments

Sorry! There are no comments related to the filter you selected.

What a silly question. (4, Funny)

Saint Aardvark (159009) | more than 7 years ago | (#16236169)

...but is blocking really twice as effective as just warning users?

No, of course not. That's why I tape the root password for the file server to users' monitors, but warn them strongly not to use it.

Re:What a silly question. (1)

E IS mC(Square) (721736) | more than 7 years ago | (#16237177)

Err..

The real questions:

Provided that
1) If you block and earn twice the point, and
2) If you warn and earn as many as half the points you earn by blocking

how many point you would earn if

a) You warn 34 sites and block half as many as you have warned
b) You block twice as much sites as you have warned

Also, which one is more effective?

Remember, you will earn as much as twice the score for answering first quetion right, but as much as half the score for answering the second question wrong.

Yes, if you want to win the bakeoff (2, Insightful)

EmbeddedJanitor (597831) | more than 7 years ago | (#16237769)

Of course the rules have been twisted to get the MS offering on top. It 2x had not worked, then it would have been 3x or 10x or whatever mgic multiplier would have got the MS device on top.

Re:What a silly question. (1)

monkeydo (173558) | more than 7 years ago | (#16238873)

Block should be worth one point, a false positive should cost one point, and warnings should be worth nothing. As Bruce Schneier once said:
You're surfing the Web and you see a button on the Web site saying,
"Click here to see the dancing pigs." And you click on the Web site
and then this window comes up saying, "Warning: this is an untrusted
Java applet. It might damage your system. Do you want to continue?
Yes/No." Well, the average computer user is going to pick dancing
pigs over security any day. And we can't expect them not to.

Re:What a silly question. (1)

bogado (25959) | more than 7 years ago | (#16244547)

The difference is of course that if you're stationg that you are paypl or a bnk or any other site that site that handles money and credit-cards people should be more careful with the warnings. I am not saying that they would be, but surely they should be. If you walk in the steet fanning your self with several 100$ bills don't you think sooner or latter someone will mug you? I believe that people can learn.

The "dancing pig" is another thing. Browser should block every kind of executable of being run directly from it. If you see a link "get here the dancing pigs" that is connected with a .exe, .pif, .scr or any other extension that MS think that it should be runned the browser should make it as hard as possible to be able to run it.

What do most users do when they get a warning box? (4, Insightful)

chroot_james (833654) | more than 7 years ago | (#16236189)

"What is this window doing here?! I just want to get to paypal already..." *clicks ok* "There. Now I can finish this ssn and cc verification..."

Re:What do most users do when they get a warning b (1)

the_last_rites (837649) | more than 7 years ago | (#16236357)

wow MS almost was convincing with this one. I think I'll wait for the next Windows v Linux study to reaffirm my faith in MS sponsored studies

In related news (-1, Troll)

Anonymous Coward | more than 7 years ago | (#16236201)

An IBM study said that Linux was better than Windows. Slashdot saw that it was Right and Good and it became part of the evangelical open source gospel.

Do a lot of people still get phished? (1)

chroot_james (833654) | more than 7 years ago | (#16236235)

Is it just hype or is this still an effective tool?

Re:Do a lot of people still get phished? (1)

Damastus the WizLiz (935648) | more than 7 years ago | (#16236289)

Lots of people still do. Because Some people will believe anything. The biggest problem has been and always will be the user. As I keep telling the associates in the center I support. All these computers were working perfectly before you got here.

Re:Do a lot of people still get phished? (3, Informative)

xenoarch (817676) | more than 7 years ago | (#16236347)

untill December of last year i was a sysadmin for a large ISP, and when i left we still had 30+ phsing scams caught per day. Phishing is a social hack, and those are always more effective then just plain tech hacks. And yes blocking is more effective then warning.

Re:Do a lot of people still get phished? (3, Interesting)

porcupine8 (816071) | more than 7 years ago | (#16236387)

Just a few months ago, someone "broke into" my sister's PayPal account, and from there her bank account.

A couple of months after the fact, my mom let slip that not only was this actually because she fell for phishing, but my mom had fallen for the same email - luckily, they didn't get to her bank account. (Mainly b/c when my sister discovered what had happened, my mom ran to cover her ass.)

I wanted to whack them both upside the head. But trust me, they are far more representative of the average user than you or I.

Re:Do a lot of people still get phished? (2, Interesting)

kers (847541) | more than 7 years ago | (#16236799)

I am curious, how did they "get to her bank account"? A lot of my international friends have this scare of people getting to know their bank account number and I can't understand why. Is it really that easy to pull money from an account that *belong to another person*? Over here I need a valid ID or a PIN-secured cryptographic device (that look like a simple pocket calculator) just to move money between my own accounts. Is bank security really that terrible?

Re:Do a lot of people still get phished? (1)

egr (932620) | more than 7 years ago | (#16237491)

Well, I don't need that stuff to pay WoW subscription

Re:Do a lot of people still get phished? (1)

Mistshadow2k4 (748958) | more than 7 years ago | (#16238093)

http://www.deviantart.com/deviation/40535791/

Hmmm, some people might wonder why you want to know...

(j/k)

Re:Do a lot of people still get phished? (1)

porcupine8 (816071) | more than 7 years ago | (#16277743)

There are tons of things you can pay for online with just a routing # and account #, and the name on the account.

Re:Do a lot of people still get phished? (0)

Anonymous Coward | more than 7 years ago | (#16237399)

I wanted to whack them both upside the head.
I was wondering why your mother would hide such an important fact from your sister, but reading the sentence above I think I understood it better. I believe that reactions like that to people's mistakes only grow fear, making them hide them and making the whole thing worse overall.

Re:Do a lot of people still get phished? (2, Informative)

jd142 (129673) | more than 7 years ago | (#16236797)

I get calls from people asking about emails from banks that they don't even do business with!

Them: I got a message from XYZ bank that my account is frozen. Do you think it is a scam?
Me: Do you have an account with XYZ?
Them: No, I've never done any business with them.
Me: Then you can be very sure it's a scam.

Re:Do a lot of people still get phished? (4, Interesting)

merreborn (853723) | more than 7 years ago | (#16237307)

My fiance just started as a teller at a Wells Fargo. She says that people come in with questions exactly like that every single day, along with "I need a cashiers check to send to this nice man in Nigeria", and

"I just got an email saying I won the Canadian Lottery, and I need a cashiers check for $4,000 to cover the taxes"
"Did you ever _enter_ the Canadian lottery?"
"No."
"I hate to tell you this ma'am, but it's a scam."

Every god damn day.

Re:Do a lot of people still get phished? (1)

dgatwood (11270) | more than 7 years ago | (#16238169)

A fool and his money are soon parted.

---Thomas Tusser

Re:Do a lot of people still get phished? (1)

nametaken (610866) | more than 7 years ago | (#16245221)


Maybe if you make a sign that describes these most common scams, have it printed on a nice board with a very official looking Wells Fargo logo, and put it on the counter, these people will recognize their situation and believe you when you hear their story and point to it. Then maybe this board would be seen by a district manager, your fiance gets a raise for a great idea that protects the customer and fosters faith in the company, and similar fancy signs go to every Wells Fargo in the country just like that. Then, just maybe, people will see the signs all over the place and we'll see a significant decrease in scams like that all over, which will mean just a few less spam emails in everybodys mailbox, and you're a superhero. Just an idea... is it too optimistic? :)

Re:Do a lot of people still get phished? (1)

molarmass192 (608071) | more than 7 years ago | (#16237409)

For non-tech users ... this is a very effective method. We know to look for an SSL lock and to make certain the the URL matches the site, but this is total jibberish to non-techs who have no idea what a URL is supposed to look like, much less how SSL works. My advice is usually, if it comes in an email ... do not click on it. Whomever invented HTML email should be shot, it's almost as if it was purposely invented for this purpose.

Re:Do a lot of people still get phished? (1)

IT074794 (1004420) | more than 7 years ago | (#16241775)

Some information... Yes there are a lot of people still get phished out there..

In 2006 eight people were arrested by Japanese police on suspicion of phishing fraud by creating bogus Yahoo Japan Web sites, netting themselves 100 million yen ($870 thousand USD).

AOL reinforced its efforts against phishing in early 2006 with three lawsuits seeking a total of $18 million USD under the 2005 amendments to the Virginia Computer Crimes Act.

Re:Do a lot of people still get phished? (1)

fubar1971 (641721) | more than 7 years ago | (#16244011)

This actually is an effective tool. You would be suprised how many people I have here at my work that getting phishing attempts. Not through there work email, but from checking ther web mail accounts. Here at my non profit organization I have a RedHat server setup with Dan's Guardian/ClamAV/Squid Proxy. We don't filter for content, but do filter for viruses using ClamAV. It works great and reduces the number of downloaded viruses in our organization. An added bonus to this configuration that I discovered, is that when my users try and read their email through a web interface, DansGuardian/ClamAV appears to be smart enough to filter and block some of the phishing attempts. Now it does not matter what browser or toolbar they use.

I hate slashdot so much (5, Insightful)

anotherone (132088) | more than 7 years ago | (#16236249)

If anything, blocking a site should be worth more than double, since most people I know seem to just ignore warning dialogs.

Re:I hate slashdot so much (1)

Mr2cents (323101) | more than 7 years ago | (#16236769)

If blocking a non-phishing site doesn't cost points, I'm sure I can come up with a filter that performs even better!

Re:I hate slashdot so much (3, Insightful)

jrumney (197329) | more than 7 years ago | (#16236925)

If anything, blocking a site should be worth more than double, since most people I know seem to just ignore warning dialogs.

My first thought was that the false positive rate is probably going to be about the same as WGA, blocking far too many sites, but you're right. The ideal solution would be to have it configurable and default to blocking, since the users who click through without reading are probably not going to go anywhere near the Options dialog.

BS composite scores didn't make a huge difference. (3, Informative)

dtfinch (661405) | more than 7 years ago | (#16236261)

Disregarding their arbitrary scoring BS, and only looking at detection percentages, IE7 still did a good job, as expected from a Microsoft commissioned study.
GeoTrust TrustWatch caught 99%, but had a 32% false positive rate.
IE7 - 89%
Netcraft Toolbar - 84%
EarthLink ScamBlocker - 64%
Firefox/Google - 53%
eBay Toolbar - 46%
Netscape 8.1 - 28%
McAfee Site Advisor - 3%

How they came out with only 89% when they selected the sites themselves is anyone's guess.

Re:BS composite scores didn't make a huge differen (1)

skelly33 (891182) | more than 7 years ago | (#16236403)

"How they came out with only 89% when they selected the sites themselves is anyone's guess."

Perhaps they thought nobody would actually believe the 100% figure they had originally planned to report - after all, 89% of statistics are made up on the spot by a caucasian male under the age of 35...

Re:BS composite scores didn't make a huge differen (1)

cp.tar (871488) | more than 7 years ago | (#16238381)

89% of statistics are made up on the spot by a caucasian male under the age of 35...

... as shown in the research done by Professor Togashi Raichu, a professor of Statistical Analysis at Tokyo University.

Statistics are much more credible when backed by reliable sources.

Re:BS composite scores didn't make a huge differen (2, Funny)

GBWisc (659950) | more than 7 years ago | (#16236443)

Don't you think 99% or 100% would have been a little "phishy"?

Re:BS composite scores didn't make a huge differen (1)

Depili (749436) | more than 7 years ago | (#16236473)

Maybe they also wanted to google/firefox to perform as badly as possible on the same dataset.

Re:BS composite scores didn't make a huge differen (1)

morgan_greywolf (835522) | more than 7 years ago | (#16236937)

Maybe they also wanted to google/firefox to perform as badly as possible on the same dataset.

Ding! Ding! We have a winner!

Microsoft-sponsored benchmarks are almost always about making the other guy look bad, while inflating their own performance. Think of the 'Get the FUD^WFacts' campaign or the tests that pit Windows 2K3 Server against Samba, where the Red Hat box was tuned -- on purpose -- to the worst possible setting.

You only have to look better than your next biggest competitor in Microsoft's playbook.

False positives = bad site design? (2, Interesting)

G4from128k (686170) | more than 7 years ago | (#16237285)

GeoTrust TrustWatch caught 99%, but had a 32% false positive rate.

I'd be interested to know about these false positives. I'd bet that some legitimate sites use designs that are are hard to distinguish from phishing sites. I would argue this is bad.

Perhaps GeoTrust is right and the false positive sites are wrong.

Re:False positives = bad site design? (1)

Tim C (15259) | more than 7 years ago | (#16241997)

I can't vouch for false-positives for websites, but Thunderbird routinely thinks that the monthly Sun Developer Network Program newsletter is a scam, and quite often labels developer mails from Microsoft as scams too. Ignoring the obvious jokes, it's irritating, especially as there seems to be no way to configure it (other than turning it off) and it completely fails to catch most of the real scam mails I get...

Stupid questions (3, Insightful)

Solkre (787360) | more than 7 years ago | (#16236271)

Why do all article descriptions end with a stupid question?

And for those who disagree, there ARE stupid questions.

Re:Stupid questions (0)

Foofoobar (318279) | more than 7 years ago | (#16236587)

There are no stupid questions... only stupid answers.

Re:Stupid questions (3, Funny)

kfg (145172) | more than 7 years ago | (#16236695)

Q.E.D. :)

KFG

Because IE doesn't block them (1)

EmbeddedJanitor (597831) | more than 7 years ago | (#16237819)

On Firefox I don't see any stupid questions.

Re:Stupid questions (1)

Jugalator (259273) | more than 7 years ago | (#16238003)

And for those who disagree, there ARE stupid questions.

Or at least leading questions. :-p

Re:Stupid questions (1)

OmnipotentEntity (702752) | more than 7 years ago | (#16238985)

There are no stupid questions.

There are, however, quite a few inquisitive idiots.

Re:Stupid questions (0)

Anonymous Coward | more than 7 years ago | (#16245931)

To spur discussion, perhaps?

Actually... (1)

Otter (3800) | more than 7 years ago | (#16236293)

Blocking a phishing Web site earned you twice as many points as just warning about it in this test, but is blocking really twice as effective as just warning users?

In fact, blocking is pi times as effective as warning, so this result is even better for IE than it appears. (Yeesh, even by Obligatory Stupid Question standards, that one was pretty stupid.)

Re:Actually... (-1, Troll)

Anonymous Coward | more than 7 years ago | (#16236373)

Hey! FUCKHEAD! I told you to STFU already on Slashdot. No one gives a fuck what you say moron. Now crawl back into your Porsche, drive off the side of a cliff and die.

Actually.... (3, Insightful)

zappepcs (820751) | more than 7 years ago | (#16236317)

It is the blocking part without user interaction that provokes that 'just click ok' reflex all the time. When the OS (or any machine, service, etc.) coddles the user to the point that they don't know what they are doing, or having the computer do, it breeds ignorance. No, I'm not dumb enough to think that all computer users must be sysadmins, but software that deepens their ignorance is not good software. Intelligent software should tell user's what is happening, why(if possible), and what the software can do about it, and/or what the user should do about it. I know that clippy was pretty annoying, but a less annoying and more intelligent approach like clippy would help user's to make better security decisions in the future. Just two cents worth.

Re:Actually.... (2, Insightful)

merreborn (853723) | more than 7 years ago | (#16237465)

As much as I'd love to agree with you, your average user doesn't *care* what the computer's doing, or what their options are. They just want their email. They don't *want* to know any more than they absolutely have to.

That, bundled with way too many dialogs asking them questions they don't know the answers to, has resulted in the "Just click yes" reflex.

By way of example -- the first time you submit a form in any browser, you get that "You're about to send unsecured information over the internet!" dialog. Do you know *anyone* who's ever pressed anything other than the "Never tell me this again" button?

Sure, it tells the user exactly what the computer's doing, but honestly, it's just not useful. Either you already understand what that means, and don't need the dialog at all, or you haven't a god damn clue -- in which case, a 12-word dialog isn't really going to educate you on HTTP, packet sniffing, SSL, and HTML forms.

Re:Actually.... (1)

Todd Knarr (15451) | more than 7 years ago | (#16239117)

People don't care about what their car's doing or what all those road signs mean or why they should be looking ahead of them while driving, all they want to do is go places in their cars. But we still force them to prove they do know all those things they don't care about, on pain of not being allowed to drive, because their not knowing would endanger others. I fail to see why the same shouldn't hold for computers.

Re:Actually.... (1)

merreborn (853723) | more than 7 years ago | (#16239231)

I don't think anyone's been killed by a computer-ignorant octogenarian checking his email.

People have been killed by those not fit to drive. (And it's worth noting that the system hasn't proven too good at keeping those people off the road, by the way)

Ignorant computer users pose a minimal risk to life and property.

Theoretically, in the 'land of the free', we don't legislate activities that pose little risk to otherwise uninvolved parties. Of course, there are numerous examples of this not actually happening in reality, but that's beside the point.

Why invite the government where it's not absolutely needed?

Re:Actually.... (1)

chmod a+x mojo (965286) | more than 7 years ago | (#16240297)

Well.... not yet. But it does get closer everyday, the more spam i get the more my Blood Pressure goes up.... it's gotta pop soon.

And yes i blame all the clueless n00bS out there that let their PC's get zombified.

Re:Actually.... (1)

madcow_bg (969477) | more than 7 years ago | (#16240827)

I don't think anyone's been killed by a computer-ignorant octogenarian checking his email.
Oh, sure, it is sooo coool to have your identity stolen, just because one friend of yours didn't care. Actually, there are fates worse than death.

People have been killed by those not fit to drive. (And it's worth noting that the system hasn't proven too good at keeping those people off the road, by the way)
Are you sure? Becaus you don't know what is going to happen without those rules, it has never been tried. Oh, wait, it is being tried - try some third world capital?

Ignorant computer users pose a minimal risk to life and property. ... unles you mean your identity, therefore all your property. And if you kill yourself because you're broke, yup, that is just an incident. Lucky me, no harm done, whatsoever...

Theoretically, in the 'land of the free', we don't legislate activities that pose little risk to otherwise uninvolved parties. Of course, there are numerous examples of this not actually happening in reality, but that's beside the point.
Legislate? Why not just educate the people. Mandate encryption. If people don't want to know, they shouldn't get a computer. They should not be allowed to use online banking and stuff. If you can't do it online, go to your local bank branch. It will be better.

Why invite the government where it's not absolutely needed?
Because it is clearly getting out of hand. No legislation, the government does more than that - spending money in the right direction, that is the way.

Sadly, yes (2, Insightful)

Angst Badger (8636) | more than 7 years ago | (#16236361)

[...] but is blocking really twice as effective as just warning users?

While I am loath to say anything positive about Microsoft, I'd have to agree with the scoring. Most end-users, especially the developmentally challenged ones that are prone to phishing scams, simply do not read warnings. If someone is drooling, it does no good to tell them. Just wipe their chin.

Re:Sadly, yes (0)

Anonymous Coward | more than 7 years ago | (#16243345)

That's great and all, but this anti-phishing stuff only works in IE v7. Why is this bad? Most of the folks you are talking about are still using Windows '98 and Windows 2000. Some of them are still running IE 5, though most are on IE 6.

It's great for Microsoft (promotes upgrades), but does nothing for the masses. The other toolbars listed also work for IE 6, and other browsers, and more importantly run on Windows 2000, and probably '98.

That makes the other toolbars *MUCH* more effective IMHO.

Yes... (2, Insightful)

loraksus (171574) | more than 7 years ago | (#16236407)

Because your average user is stupid and will click away any phishing warning, especially if the email says "You may see a dialog like this, click yes/ignore (just like installing your printer, scanner, tv card, etc drivers)"

I really don't want to advocate handholding, but some people really do need it..

Re:Yes... (1)

God Of Atheism (1003892) | more than 7 years ago | (#16236753)

Maybe people should be required to get an internet license before being allowed on the internet? (just like a drivers license but for the internet)

On a similar note, I think candidate politicians should pass some exam that tests their ability to function in stressful situations as well as their ability to conduct long term planning in spite of the pressure of the next elections, before being allowed to become a candidate. Other things which would be suitable to test include corruptability, taking responsibility, and how easy they let their sexual urges take over.

Re:Yes... (0)

Anonymous Coward | more than 7 years ago | (#16240491)

What's needed is a buried setting that specifies how many warning messages you have to go through with the default set to something like 30. The technologically hopeless will give up long before that and everyone else will be able to change the setting for themselves

Template for MS Slashdot Articles (4, Insightful)

derrickh (157646) | more than 7 years ago | (#16236435)

Microsoft did something right...but is that something actually not wrong?

Microsoft performed well...but is performing well more important than performing badly?

Microsoft isnt all bad...but is not being bad the same as being good?

D

Re:Template for MS Slashdot Articles (1)

Soko (17987) | more than 7 years ago | (#16237275)

More like "Microsoft did something right, but thier marketing department is pushing it to be way better than everything else in technically questionable ways."

I'd add "Again." to the end of that, myself.

Soko

Mmmmm, Pie... (1)

Hobbes897 (782722) | more than 7 years ago | (#16236457)

At first when I read the post title I thought Microsoft was going to have an actual baking competition. "Wow," I thought, "That would be an awsome way to spread the antiphishing message to the common Windows user." Alas, it was not to be. Maybe I was just overcome by the image of apple pie cooling by the monitor, fresh from the gentoo box. *sigh* Memories...

Re:Mmmmm, Pie... (1)

$RANDOMLUSER (804576) | more than 7 years ago | (#16236837)

Sorry, Microsoft only does mincemeat pie.

Re:Mmmmm, Pie... (0)

Anonymous Coward | more than 7 years ago | (#16240683)

judging from the bugs in most of their software, i'm not sure i want baked goods from MS, rich in protein as they might be.

Re:Mmmmm, Pie... (1)

AmberBlackCat (829689) | more than 7 years ago | (#16241441)

Man, now I gotta bake a pie.

Re:Mmmmm, Pie... (1)

jacquems (610184) | more than 7 years ago | (#16241487)

Microsoft would never go for apple pie. Or maybe they would, and claim it was their original recipe.

Their cafeteria did have an excellent chocolate-peanut-butter pie though (one of the only things I remember clearly from my visit there). Can anyone comment on the current state of baked goods at Microsoft?

Baked goods at Microsoft (0)

Anonymous Coward | more than 7 years ago | (#16241763)

They have a very large selection of baked goods, and they're all beautiful to look at.

Unfortunately, they all have bugs, and they're well hidden - but they put nice buttons on the table so you can submit a bug report!

They only remove the bugs on Tuesdays, however, which usually ends up letting more in.

Never mind phishing (1, Informative)

Anonymous Coward | more than 7 years ago | (#16236539)

When is MSFT going to take responsibility for the tens of thousands of windows zombies out there? Microsoft are desperate to be seen to be doing something in the eyes of the public but when it comes to the crunch, they don't give a shit!


Perhaps we should start a "Spam is a Microsoft problem" campaign until they backport Vista's security model to the millions of systems already out there?

Lets Go 'Phishing'... (1)

tt074266 (1005951) | more than 7 years ago | (#16236571)

I'd say blocking phishing web pages are great...but if MPF is ONLY able to detect the KNOW phish..i'd say thats just a waste of time..another great HYPE from microsoft...hey bill,let go phishing!!!

Re:Lets Go 'Phishing'... (1)

TT074304 (1005015) | more than 7 years ago | (#16236697)

Wow...you're sure hyped about beheading Microsoft, and hey!! we've even got the same nick (almost the same actually). My opinion is just use the IE 7 and see why they say that it is the best phishing filter, although it only blocks known phishing site. P/S: are you sure we're not related??

Re:Lets Go 'Phishing'... (1)

tt074266 (1005951) | more than 7 years ago | (#16237081)

well..if they were meant to BLOCK the known webpages..its better for them to WARN instead..IE should let people know which website to be filtered..then,after that those websites will be block forever..Dont u agree wit me??( a good HCI is where the program lets the user feel in control..:) )

Re:Lets Go 'Phishing'... (1)

TT074304 (1005015) | more than 7 years ago | (#16240709)

Hahahaha....I love this guy, ok...Let me tell you this, usually the hacker do phishing by spoofing website that often people go into, acting like those website are the real website (like trustedsite.com and trustedsite.net), there's a difference between those two site. Why the hell people want to go to the phishing site again when they know that they have been phished?? let's think about that!!

P/S: hohoho, looks like we've arguing this thing like we're going to send this comment to some lecturer of some University :D

Re:Lets Go 'Phishing'... (1)

tt074266 (1005951) | more than 7 years ago | (#16240859)

thats not the point mister..my main point is,the reason why we should put a warning sign is to notify user which site that were blocked..what if some of the sites are legitimate???and by using the IE, tadaaa..u've missed..the site had been blocked!?have u been thinkin' about it??i've experience things like that,and it does made me feel frustrated..yeah sure...what kinda jackass would visit that website once he knows that he's been spoof of?hell,we've just to make sure that end-user would want to know what the browser is blocking.. (make sure i didn't see ur face in class man..!!)

Average user ignores warnings (1)

ColinPL (1001084) | more than 7 years ago | (#16236713)

Blocking a phishing Web site earned you twice as many points as just warning about it in this test, but is blocking really twice as effective as just warning users?'"

The average user ignores all warnings so it is very important to block phishing sites.

For advanced users warning is as effective as blocking a website.

sthit (-1, Redundant)

Anonymous Coward | more than 7 years ago | (#16236971)

'doing somet4ing'

Interesting (1)

wetfeetl33t (935949) | more than 7 years ago | (#16236975)

Interesting concept...
I would say that blocking is more effective than just warning users, but to tell you the truth, as a user I want to control what I have access too. I don't want a filter blocking things for me. A warning is nice, but I can take care of blocking on my own, thank you very much. Isn't this one of the annoying things about MS products - that they try to make up your mind for you?

Re:Interesting (1)

proxy318 (944196) | more than 7 years ago | (#16237337)

Yes, I don't like blocking either, but as other people here have pointed out, your average user is dumb as a rock. So it should block by default, but with an option to turn it off for people who know better.

Rigged weighting (1)

jemenake (595948) | more than 7 years ago | (#16236993)

Blocking a phishing Web site earned you twice as many points as just warning about it in this test
This reminds me of when the "Quarterback Rating" came out back in the 80's. Back then, there were people arguing that Joe Montana was the greatest QB in history. Around that time, a "Quarterback Rating" scheme emerged with some esoteric weighting of various performance stats (completion percentage, TD's per game, etc. etc). Although nobody seemed to understand the rationale for the particular weighting... lo and behold, Joe Montana came out with the highest rating of current QB's and, IIRC, all QB's in history.

The lesson: Beware of any "combined" or "aggregate" score of competing products when the person doing the aggregating: A) has an interest in one product doing better than the others, and B) knows, beforehand, what the strengths of that product are.

Alot of NOTHING (0)

Anonymous Coward | more than 7 years ago | (#16237417)

Now this says a lot of nothing:
but it did do the best job of blocking the ones it did spot

But wait.. there's more.. (1)

shadowdodger (976256) | more than 7 years ago | (#16237429)

So there's something really important that everyone seems to be forgetting here.
Yes, blocking a site is very effective, it's most likely more than two times more effective at preventing a phishing scam for the sites that it blocks.
But at the same time, if you block 50% of the sites and users never see them, never see a message or a warning, they think that they are safe and as a result, they are less likely to look at other sites with any degree of caution.
On the other side, if you as a user are warned at every sight that coud be dangerous, and block from only a few right off the bat, then at least you've got it in the back of your mind that you need to be careful. It might actually instill the idea into people's head that they ought to look at the sites thay are traveling on.
So, what you've really created is a situation where 50% of the time it works all of the time.
Instead of a situation where your program covers your ass 30% of the time (or whatever it is, the number doesn't really matter) and then at least helps you to cover your own the rest of the time.
You take your pick.

Phishing victims (0)

Anonymous Coward | more than 7 years ago | (#16237587)

Still, most of phishing victims are windows users, those who don't know what "options" means. Any anti-phishing software installed by default would help them and irritate those who are knowledgeable.

still beta.. (1)

azman075918 (1003353) | more than 7 years ago | (#16237647)

This antiphishing will be available in Internet Explorer (IE) 7, which is not yet in public release. They release just for testing. I want to see how much it can block all unwanted thing in the IE.

Re:still beta.. (0)

Anonymous Coward | more than 7 years ago | (#16237985)

It's not a full release, yes.. But it is a publicly available beta... And it has taken over the IE site on microsoft.com - I bet we'll see many users that don't understand the concept of beta software pulling that down.

what's about this phishing stuff? (1)

tokapi4223 (1005447) | more than 7 years ago | (#16238637)

this is a great idea to have a browser with its own anti-phishing but there's some point we need to look at. The blocked sites may be not really a threat but it is blocked because someone just don't like it and report to micrsoft. There will be a great misunderstanding between the users who browse the site where the browser told them it is not a safe site to surf, but it actually safe. This phishing technology has made the browser (IE7) become more heavy. Browsing speed becoming a little bit slower and it effects the overall performance of the browser itself. However, there is option to turn off the phishing feature and this really help those who have problem when encountering site that been identified as "phishing sites". There's alaways alternative for everything.. use firefox with fasterfox.. really cool..

Results (2, Informative)

shiyun074238 (1002482) | more than 7 years ago | (#16238673)

The results of the study as below:
1. Internet Explorer 7 Beta 3 RC3 with Microsoft Phishing Filter with a score of 172 points
2. Netcraft Toolbar with a score of 168
3. Google Safe Browsing on Firefox with a score of 106
4. eBay Toolbar with a score of 92
5. Earthlink ScamBlocker with a score of 76
6. GeoTrust TrustWatch with a score of 67
7. Netscape 8.1 with score a of 56
8. McAfee Site Advisor with a score of 3

Check http://www.3sharp.com/projects/antiphishing/ [3sharp.com]

Re:Results (1)

n00bsaib0t (1001817) | more than 7 years ago | (#16242395)

i think i've seen this result b4... this result had been posted by 'dtfinch (661405)' earlier... by the way... back to the topic, just being number 1 in the results of best and secure browser mean that it is the perfect browser though... And it still in beta mode... testing mode... maybe the poll was made by people who works in the Microsoft itself, aha~ i am using IE7 by the way... and browsing the net seem to be so slow because of the 'check/verify for phishing websites'... If the browser pop up a warning window, normal user will just click ok and continue browsing the website although it was phished website.... so wats the point to have this anti phishing functionality? think to ur self... thnx..

Ratings and statistics... (1)

Fantasio (800086) | more than 7 years ago | (#16238853)

If you torture them enough they'll say anything you want.

( No truth has been hurted writing this post )

Washington Post recommends Netcraft toolbar (1)

1sockchuck (826398) | more than 7 years ago | (#16240781)

Skeptical about Microsoft's survey? Try the Netcraft toolbar, which finished a close second. Washington post security columnist Brian Krebs has written many columns about phishing, and thus surfs to known phishing sites all the time. Here's his take [washingtonpost.com] after visiting a malware site for a recent column:

"It's worth noting that Netcraft's anti-phishing toolbar detected this site as malicious and tried to prevent me from visiting it, as it is designed to do. I have to say that I've visited countless phishing sites in the past few months, and Netcraft's toolbar has done its job almost unfailingly."

toolbar.netcraft.com [netcraft.com]

blocking more secure than warning (1)

sii074306 (1004649) | more than 7 years ago | (#16240943)

I bet many of my friends out there just click "Yes" or "Ok" when there is a warning pop up window without paying attention to what the warning has said. Even sometimes they have read it but they don't understand what is all about. So the blocking will be the best action to be taken rather than just give a warning to the user.

Methods of phishing (1)

RR074862 (1003812) | more than 7 years ago | (#16241059)

Most methods of phishing use some form of technical deception designed to make a link in an email appear to belong to the spoofed organization. One method of spoofing links use web addresses containing the @ symbol, which are used to include a username and password in a web. For more details http://en.wikipedia.org/wiki/Phishing [wikipedia.org]

Just Throw in the Damn Towel. (1)

derprasiden (1007265) | more than 7 years ago | (#16241537)

Although blocking is a far greater choice than those provoking warning messages which users tend to ignore, perhaps why not throw in the towel and allow those damn warning messages to appear, you can even come up with a statistic by looking at the numbers of those who are ignorant and fall victim from this so called imposter.

RE : anti-phishing technology (1)

RR074862 (1003812) | more than 7 years ago | (#16241659)

Microsoft new IE7 browsers include a form of anti-phishing technology, by which a site may be checked against a list of known phishing sites. If the site is a suspect the user is warned, although not prevented from visiting it. This phishing technology has made the browser (IE7) become more heavy. Browsing speed becoming a little bit slower and it effects the overall performance of the browser itself. Spam filters also help protect users from phishers, because they reduce the number of phishing-related emails that users receive.

alert (1)

tt074286 (1007267) | more than 7 years ago | (#16241685)

as a user we not suppose totally depend on the software to avoid this phishing stuff. we can take a carefull step to prevent this phishing from happen to ourself. i'll shared with you all the step that will help you avoid becoming a victim of these scams:- 1. Be suspicious of any e-mail with urgent requests for personal financial information. 2. Don't be fooled by e-mails with upsetting or exciting (but false) statements that try to get you to react immediately. 3. If you suspect the message might not be authentic, don't use the links within the e-mail to get to a webpage. 4. Don't fill out forms in e-mail messages that ask for personal financial information. 5. Communicate information such as credit card numbers only via a secure website or the telephone. 6. To make sure you're on a secure Web server, check the beginning of the URL in your browser address bar. It should be "https" rather than "http." The "s" stands for secure. 7. Consider installing a Web browser toolbar such as EarthLink's ScamBlocker to alert you before you visit known phishing fraud websites. 8. If an e-mail message is not personalized, assume it's not a valid message. 9. Log in to your online accounts regularly, and check bank, credit and debit card statements to ensure that all transactions are legitimate. 10. Ensure that your browser is up-to-date and security patches have been applied. credits:- http://www.csoonline.com/read/090104/briefing_phis h.html [csoonline.com]

maybe they need more understanding the definition (1)

tt074269 (1004000) | more than 7 years ago | (#16241887)

Phishing is online identity theft in which confidential information is obtained from an individual. Phishing includes deceptive attacks, in which users are tricked by fraudulent messages into giving out information; malware attacks, in which malicious software causes data compromises; and DNS-based attacks, in which the lookup of host names is altered to send users to a fraudulent server

The Gartner group estimates that the direct phishing-related loss to US banks
and credit card issuers in 2003 was $1.2 billion. Indirect losses are much higher,
including customer service expenses, account replacement costs, and higher
expenses due to decreased use of online services in the face of widespread fear
about the security of online financial transactions. Phishing also causes
substantial hardship for victimized consumers, due to the difficulty of repairing
credit damaged by fraudulent activity.

So, as long Microsft can prevent from any online thief with effectively, users will happy about it.

no. 1 doesn't mean the Best (1)

vz3phyre (1003163) | more than 7 years ago | (#16241969)

I dont surprise because Microsoft are really good in this kind of strategy.
They wont tell average user that they get the high score in blocking the url, but they will absolutely tell them that "We have no.1 antiphising toolbar!".

Maybe for them, blocking the url is much more efficient to prevent their customer rather than warn them. This is because their customer (most are not computer geeks) maybe be not aware about "phishing" threats; "Phishing?? Is it a new cool words from Microsoft refer to fishing?" -- 8P

If they give a warning to their customer, may be the customer will just ignore it.

So, lastly i would prefer if the customer know all details and let them make their own choice. No. 1 doesn't the best but poor score toolbar mean horrible (especially with a big scores gap)

Hmm..... (1)

IT072093 (1007295) | more than 7 years ago | (#16242091)

In my opinion if someone knows what a phishing website is then they don't need a phishing filter.

And if they don't know what a phishing site is then they probably wouldn't understand the importance of enabling the phishing filter.

As soon as I got IE7 beta1 I disabled the filter because it seemed to be slowing things down. (I've uninstalled the beta btw)

And I believe anti-phishing heruistics is useless. All phishers will check their websites against IE7's filter and modify their techniques till IE7 stops detecting them.

the solution is .. (1)

rs232 (849320) | more than 7 years ago | (#16242733)

The real solution is an email system with end to end encryption and digital signatures. Basically an email doesn't pop up in your inbox unless it passes these tests. The same with e-commerce sites. You sign up to a provider who allocates you a PGP key which is then published to a number of online directories. Why we don't have such a solution is that the security services won't be able to monitor our online activities.

Antiphishing made easy. (1)

SCHecklerX (229973) | more than 7 years ago | (#16243327)

  1. As an ISP, offer your users the ability to alias their mail address for companies they do business online with.
  2. If the user receives mail from that company not to the alias they registered, it's obviously a phishing attempt or spam. Heck, the ISP could just drop it altogether based on the mail routing information.
  3. profit?
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>