Derived trust

Eric Norman, commenting on my chastization of Chase asks me:

Do you have any idea about what your mother would have an easy time of? That is, your mother would be able to say, "Yes, this is my bank", or "Wait a minute; something is wrong here" and get the right answer every time.

Would the green address bar be enough for your mother?

I started to answer in a comment myself, then thought that this topic was important enough to require its own discussion topic.

The answer to the "green address bar" being enough, of course, is: No. Color, pretty locks, etc. would not be enough for my mother nor, I suspect, many other mothers, fathers, brothers, sisters, etc.

What my mother needs is a means of deriving the trust of a site from other people that she knows and trusts and to have any site that isn't on that list to either be totally blocked or to set off all kinds of bells and whistles so that it's impossible for her to not realize she's walked out of the nice safe world into the dark inner city of the internet.

My mother would trust sites that I, or probably most of my siblings, had said were OK (which is essentially how she does things today, but with a phone call and without protection within the platform that she really is looking at the actual site one of us said was OK).

This would require some client enhancements in browsers and possibly in mailers, some reputation based host that she could point her client towards to say "include Conor's list in my set of sites," a means to get real-time approval, support for multiple such lists (so she could include my sister's list, or my brother's list) etc. etc. I think she would set it to block any non-OKed sites. Others would probably want to be able to add their own sites as well.

As I think about this, much of it feels like the kind of infrastructure AOL has in place for their parental controls (where the parent can control what their youngster has access to), though this would be the reverse direction and rather than a control, it would be advisory (because my mother could change the settings on her browser and do whatever she wants on her computer).

Tags : trust / safety / phishing / AOL / parental controls / reputation

Amex isn't exactly helping...

Speaking of phishing, while I was off attending the RSA Security Conference, American Express called and left a message on our home phone asking me to call them about some charges on my account. They added that this was not a sales call -- they weren't trying to sell me anything.

So, I pulled out my handy AmEx card and called the number on the back of the card. After wading through the "we want our computer to talk to you" menus and finally getting to a person, the customer service agent, who was very nice, was unable to tell me why they called and said everything looked alright, so the problem must have been fixed.

Later that week, I received another call from them. This time they left an 800 number that they wanted me to call and again were clear about this not being a sales call (not sure what they expect me to interpret that as since most sales guys would say the same). Of course, following good guidelines for identity theft prevention I would not call a number left on my answering machine, so I again called the number on my card.

Again, they had no clue why I was calling and told me I should call the number that was left on the message. I told them that I wouldn't call a number left on my answering machine. They asked for the number and after about 5 mins on hold, they connected me through the people who were calling and leaving messages. Apparently it's a different branch of Amex that looks at strange merchant transactions vs strange member transactions.

I pointed out that there was a problem with their system and that I wouldn't call a number left on an answering machine, but they said it would be ok... I don't understand that and I questioned them saying that if I called them they would ask me for information that identifies myself and that's exactly what a phisher would want... "Oh we wouldn't do that"...

Clearly they need to fix this as this is the exact behavior that leads to consumers having the identity stolen. At the minimum, I should be able to call the number on my card to resolve any problems/queries they might have.

Tags : identity / phishing / identity theft / American Express

Using Ebay to phish Ebay...

In what I think is the best phishing attempt I have seen for an eBay account, I received a question about my currently running eBay auction (and this question was sent to me via eBay's messaging system and viewable directly online in their messaging system)...

I want to know if this is the same item with the item listed at this address: http://members.ebay.com/aboutme/**********
From: imabrit! (1246)

Now, I know I did not list the same item under some other user, and I noticed that the sender of this message was someone who had a rating of 1246 (for real), so I went to look at the item to see what's up and I got to the following page:

This looks like a normal eBay login page. This is hosted on eBay (the URL for the page is on eBay). One might even expect to be prompted for authentication before they could look at another user's profile. However, I knew I already had a live authentication session at eBay and therefore shouldn't be prompted for credentials. So, I started to wonder if this was a phish attempt.

First I checked the URLs and the links and they all looked fine (yes this page was coming from eBay's site. Then I checked the page by walking to the page through the member profile lookup on the Community page. I still ended up with the same page that looks legit and is hosted by eBay.

But, it still didn't feel right, so I pulled up the source for the HTML page and much of it was the normal eBay page. However, the data entry form had the following code:

<form ... action="http://us.1.p10.webhosting.yahoo.com/forms?login=....." onSubmit="return checkForm0()">

This submits the form data to a web server hosted at Yahoo (not one of Yahoo's own services, but they allow others to pay for hosting).

I don't know how the average user could ever figure this out and I would expect that many, if not most, phishing aware technologists would also fall prey to this one (yeah, I do think I'm special :-)).

UPDATE (2/17): It's actually easier to tell than I thought (after looking closely at the real sign-in page): The URL for any eBay login MUST start with https://signin.ebay.com. Now, I've been an eBayer since 1998 and I pay close attention to phishing attempts, but I couldn't have quoted that to you until I looked for it today, so I'm not sure how many others will know.

Tags : identity / phishing / ebay / yahoo / identity+theft