Concerns over Google & Mozilla anti-phishing

by Brian Turner

If you're new here, you may want to subscribe to my RSS feed. Thank you for visiting!

Security

Concerns have been raised about the Google & Firefox anti-phishing drive, after it was revealed that the publishing of raw data online contained usernames and passwords of phishing victims.

Reports that personal data was being published was raised as far back as September 2006, but so far changes have not apparently been made to address the issue.

It’s not the only problem raised - there have been additional reports of mistaken identity, where even bonafide banking sites have been highlighted as phishing sites.

Overall, despite privacy concerns previously raised, the anti-phishing initiative between Mozilla and Google remains a laudable initiative.

However, the reports highlighted show that there are very important changes required to ensure the protection of users from having their login information when phished published openly online.

Additionally, it may be useful to see a whitelist of acceptable banking domains being introduced, to help reduce the risk of warnings of false positives.

This latter point should be especially picked up by Microsoft, whose recent security “improvements” to Internet Explorer 7 means that it cannot tell the difference between routine use of security certificates and abusive use of domain names.

Webmasters frequently require use of shared security certificates, such as logging into CPanel, or logging into Adsense via Google UK rather than Google.com.

However, in both types of instances, routine use of shared security certificates will cause IE7 to issue a very stark security warning. Not only is the warning plainly wrong, but crying wolf may also desensitive users to actual phishing attacks.

Questions? Discuss this in our Internet Business forums for help and advice

Story link: Concerns over Google & Mozilla anti-phishing

Add to Bookmarks: