Comments on: Fighting phishing with counter-passwords http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords It's all spinning wheels and self-doubt until the first pot of coffee. Thu, 11 Mar 2010 12:23:09 +0000 hourly 1 http://wordpress.org/?v=3.0-alpha By: dieter.ca/blog » Blog Archive » Links, Week 41/05 http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-10318 dieter.ca/blog » Blog Archive » Links, Week 41/05 Thu, 27 Apr 2006 20:09:25 +0000 http://decafbad.com/blog/?p=735#comment-10318 <p>[...] An interesting counter-phishing idea. [...]</p> [...] An interesting counter-phishing idea. [...]

]]> By: Dougal Campbell http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-2503 Dougal Campbell Fri, 14 Oct 2005 21:31:50 +0000 http://decafbad.com/blog/?p=735#comment-2503 <p>Several sites I deal with already do something along these lines. For example, many banks and credit card companies will start the messages with something like "This message is in regard to your account ending with 9876". And some other sites will include your full name and/or login name. Which may or may not be useful, depending on how public that information is on that particular site (or in general).</p> Several sites I deal with already do something along these lines. For example, many banks and credit card companies will start the messages with something like “This message is in regard to your account ending with 9876″. And some other sites will include your full name and/or login name. Which may or may not be useful, depending on how public that information is on that particular site (or in general).

]]> By: Saltation http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-2499 Saltation Fri, 14 Oct 2005 13:55:26 +0000 http://decafbad.com/blog/?p=735#comment-2499 <p>gads, someone who knows what "shibboleth" means</p> gads, someone who knows what “shibboleth” means

]]> By: bhiv http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-2490 bhiv Thu, 13 Oct 2005 20:40:47 +0000 http://decafbad.com/blog/?p=735#comment-2490 <p>How about entering a serious of gibberish into the phisher's database? This way, when they try out their database the institution (say paypal.com) can notice that there are many failed logins from them? Or even automate it (amavis flags phishing attempts)</p> How about entering a serious of gibberish into the phisher’s database? This way, when they try out their database the institution (say paypal.com) can notice that there are many failed logins from them? Or even automate it (amavis flags phishing attempts)

]]> By: Bill Seitz http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-2488 Bill Seitz Thu, 13 Oct 2005 19:26:08 +0000 http://decafbad.com/blog/?p=735#comment-2488 <p>Wouldn't it be simpler to generate a custom From address which you could add to your AddressBook/WhiteList? Of course, you have to worry about having multiple computers with unsynched WhiteLists...</p> <p>Then of course there's the custom RSS feed to get you to subscribe to...</p> Wouldn’t it be simpler to generate a custom From address which you could add to your AddressBook/WhiteList? Of course, you have to worry about having multiple computers with unsynched WhiteLists…

Then of course there’s the custom RSS feed to get you to subscribe to…

]]> By: Matt Brubeck http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-2487 Matt Brubeck Thu, 13 Oct 2005 18:53:20 +0000 http://decafbad.com/blog/?p=735#comment-2487 <p>This has the <a href="http://usablesecurity.com/2005/07/23/simon-says/" rel="nofollow">Simon Says problem</a>: It requires users to notice when something is <em>not</em> present. For the same reason that users don't notice the absense of the SSL "lock" icon, they won't notice the absence of the counter-password or passmark or whatever -- at least not enough of the time.</p> This has the Simon Says problem: It requires users to notice when something is not present. For the same reason that users don’t notice the absense of the SSL “lock” icon, they won’t notice the absence of the counter-password or passmark or whatever — at least not enough of the time.

]]> By: Nick http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-2486 Nick Thu, 13 Oct 2005 18:43:59 +0000 http://decafbad.com/blog/?p=735#comment-2486 <p><i><b>Psycho:</b> The name's Francis Sawyer, but everybody calls me Psycho. Any of you guys call me Francis, and I'll kill you.</i></p> <p><i><b>Leon:</b> Ooooooh.</i></p> <p><i><b>Psycho:</b> You just made the list, buddy. Also, I don't like no one touching my stuff. So just keep your meathooks off. If I catch any of you guys in my stuff, I'll kill you. And I don't like nobody touching me. Any of you homos touch me, and I'll kill you.</i></p> <p><i><b>Sergeant Hulka:</b> Lighten up, Francis. </i> I notice that the Bank of America website calls it a passmark. I like that.</p> Psycho: The name’s Francis Sawyer, but everybody calls me Psycho. Any of you guys call me Francis, and I’ll kill you.

Leon: Ooooooh.

Psycho: You just made the list, buddy. Also, I don’t like no one touching my stuff. So just keep your meathooks off. If I catch any of you guys in my stuff, I’ll kill you. And I don’t like nobody touching me. Any of you homos touch me, and I’ll kill you.

Sergeant Hulka: Lighten up, Francis.

I notice that the Bank of America website calls it a passmark. I like that.

]]> By: mike http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-2485 mike Thu, 13 Oct 2005 18:13:12 +0000 http://decafbad.com/blog/?p=735#comment-2485 <p>Ummm why fool around with stenography when we've got such an abundance of public key schemes? And no I don't think 'lightweight' or 'too hard for aunt minnie' count as reasonable answers. If it's worth doing it's worth doing well.</p> Ummm why fool around with stenography when we’ve got such an abundance of public key schemes? And no I don’t think ‘lightweight’ or ‘too hard for aunt minnie’ count as reasonable answers. If it’s worth doing it’s worth doing well.

]]> By: Sencer http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-2484 Sencer Thu, 13 Oct 2005 18:01:39 +0000 http://decafbad.com/blog/?p=735#comment-2484 <p>Actually that's already being done by some banks in a slightly different way. Schneier was writing on hos blog about it a while back. Here is an example of it:</p> <p>http://www.bankofamerica.com/privacy/passmark/</p> Actually that’s already being done by some banks in a slightly different way. Schneier was writing on hos blog about it a while back. Here is an example of it:

http://www.bankofamerica.com/privacy/passmark/

]]> By: Dorothea http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-2482 Dorothea Thu, 13 Oct 2005 17:53:41 +0000 http://decafbad.com/blog/?p=735#comment-2482 <p>The credit union I used in Madison (uwcu.org) does this. I gave their system an incredibly silly but highly memorable phrase from a college roleplaying campaign, and they include it in the email they send me.</p> <p>Which never fails to make me grin. Added bonus.</p> The credit union I used in Madison (uwcu.org) does this. I gave their system an incredibly silly but highly memorable phrase from a college roleplaying campaign, and they include it in the email they send me.

Which never fails to make me grin. Added bonus.

]]> By: Roger Benningfield http://decafbad.com/blog/2005/10/13/fighting-phishing-with-counter-passwords/comment-page-1#comment-2481 Roger Benningfield Thu, 13 Oct 2005 17:23:20 +0000 http://decafbad.com/blog/?p=735#comment-2481 <p>How about "lightweight credentials"?</p> How about “lightweight credentials”?

]]>