RE: New Use Case for W3C WSC

I am saying that is what I believe is happening today with Outlook and IE7,
at least that seems to be the behavior I have with my system. 

With SBM, we were talking about web browsing and not email behavior, but I
was initially thinking that if we extended it to email, then when SBM is
invoked, all non-EV signed email with bank logo type, would be blocked.

-----Original Message-----
From: Serge Egelman [mailto:egelman@cs.cmu.edu] 
Sent: Friday, August 24, 2007 2:22 PM
To: Dan Schutzer
Cc: 'Bob Pinheiro'; public-wsc-wg@w3.org
Subject: Re: New Use Case for W3C WSC

Are you now saying that SBM will invoked for *all* non-EV signed email
messages?  Because then you've just turned SBM on its head: SBM gets
turned on for mostly non-banking-related URLs, if we assume that all the
banks will get EV certificates (which I'm not willing to concede).

serge

Dan Schutzer wrote:
> If the email is signed by a special EV type certificate, the email client
> can easily be smart enough to distinguish. And the user can be blocked
from
> accessing the link unless they type an SBM sequence. No AI is needed.
> 
> It is extremely hard to distinguish from the content, especially since
many
> phishers now resort to images in order to escape content filters.
> 
> -----Original Message-----
> From: public-wsc-wg-request@w3.org [mailto:public-wsc-wg-request@w3.org]
On
> Behalf Of Bob Pinheiro
> Sent: Friday, August 24, 2007 1:55 PM
> To: Serge Egelman; public-wsc-wg@w3.org
> Subject: Re: New Use Case for W3C WSC
> 
> 
> You seem to be saying that if a user's email client is smart enough 
> to determine whether an email *may* be from a bank, then the email 
> client can be made smart enough to actually distinguish between real 
> banking emails and fake ones.  I'm not sure why one would necessarily 
> follow from the other.  Do you have any papers/links that would 
> explain how this works?  Thx.
> 
> At 01:21 PM 8/24/2007, Serge Egelman wrote:
>> The issue is, if the software is intelligent enough to think that the
>> message *may* be from a bank (and do this with a low enough false
>> positive rate that users don't ignore it), then why not just
>> automatically filter out the phishing message?  Based on studies we've
>> done with phishing detection, if a message can be categorized as being
>> bank-related (either from a bank or a phishing message) or all other
>> mail, it's then fairly straightforward to make a distinction between
>> real bank messages and phishing messages.  At that point we can alert
>> the user to the phishing message fairly effectively.  This is why I
>> don't think the SBM mode is practical.
>>
>> serge
>>
>> Bob Pinheiro wrote:
>>> Yes, there well may be an issue with users invoking SBM before clicking
>>> a link in their email.  That's why I proposed that one alternative might
>>> be to remove that issue by making the user's computer (email client?
>>> browser?) "smart" enough to sense that when an email might potentially
>>> be from a bank, the browser could prompt the user and ask if SBM should
>>> be invoked.  So I am assuming some sort of "intelligent" link between
>>> the email client and the browser, with the email client triggering the
>>> browser to invoke a procedure for prompting the user to invoke SBM based
>>> on some keywords or phrases in the email header.  But is that so
>>> wrong?   It may not exist today - all I am suggesting is that it might
>>> be one avenue to consider (and not necessarily by this group) as a way
>>> to prevent users from visiting fraudulent banking sites by clicking on
>>> email links if they haven't first invoked SBM.   But this is getting of
>>> the beaten track, I guess......
>>>
>>> At 11:55 AM 8/24/2007, Ian Fette wrote:
>>>> This is going to rapidly take me down a divergent path, but I shall
>>>> follow said path anyways.
>>>> One of the biggest problems I have with SBM is invocation. You can't
>>>> really expect users to invoke SBM before clicking a link in their
>>>> email, because when they're reading their email their browser might
>>>> not even be open (except for all the wonderful gmail users out there
>>>> ;-). But seriously, when you click on a link in Thunderbird or Outlook
>>>> or Lotus Notes or whatever it is that you use to read email, that
>>>> email program just knows that it's supposed to open that link in a
>>>> browser (sometimes... if it has no clue, it might just shellexecute
>>>> the URL and let the OS figure out what to do with it). Either way,
>>>> unless the default browser is set to "Browser with SBM Mode Turned
>>>> On", links from email are going to get loaded in non-SBM mode.
>>>>
>>>> So, let's now go back to your response. Let's say that the user is
>>>> educated enough to understand that SBM should be invoked before
>>>> visiting any banking websites. (I personally find this a troublesome
>>>> assumption, but let's run with it). Is the user then supposed to start
>>>> a web browser, enter SBM mode, and then cut and paste the link from
>>>> their email? That's a usability disaster, and I doubt anyone would
>>>> actually figure out that those steps were required. Even if a user
>>>> opens a browser and starts SBM, clicking on a link in an email program
>>>> would very likely just start a new browser window (probably without
>>>> SBM enabled... and when a user is in SBM mode, do you really want
>>>> links from external programs to be able to clobber the current
>>>> window?).  In my mind, we're heading for a usability disaster here.
>>>>
>>>> Further, in your use case below, you're assuming a strong tie-in
>>>> between a user's MUA (email client) and their browser, which is often
>>>> not the case. In some cases the two are strongly tied together, but in
>>>> many cases when an email client gets a URL and the user clicks on it,
>>>> it just throws the URL to the operating system and says "deal with
>>>> it". And we're already well down the path of suggesting extensions to
>>>> MUAs (email clients) to do machine learning to detect possible
>>>> bank-like emails, and I fear this is getting way out of scope of the
>>>> WG...
>>>>
>>>> On 8/24/07, *Bob Pinheiro* <Bob.Pinheiro@fstc.org
>>>> <mailto:Bob.Pinheiro@fstc.org>> wrote:
>>>>
>>>>     I think there may be a tie-in here with Safe Browsing Mode.
>>>>     Suppose the user is educated enough to understand that SBM should
>>>>     be invoked before visiting any banking websites.  Then upon seeing
>>>>     the email, the user should invoke SBM before clicking on the
>>>>     apparent banking link.  If that is done, then instead of
>>>>     displaying the ERROR 404 message, the user should see whatever is
>>>>     displayed by SBM when the user attempts to visit a non-safe
> website.
>>>>     But if it is true that "education does not consistently produce
>>>>     the results desired", then there may be numerous times when even
>>>>     users who are aware of SBM do not actually invoke it when they
>>>>     should; that is, before visiting banking websites.  So a question
>>>>     worth asking might be: can a user's browser be made "smart" enough
>>>>     to sense that a website that the user wants to visit might
>>>>     possibly be a banking website?  The user can easily sense this
>>>>     because the Use Case says that the email claims to be from the
>>>>     user's bank.    If the user's computer can somehow "read" the
>>>>     email header, it might display a message saying "I sense that you
>>>>     are attempting to visit a possible banking website.  However, it
>>>>     is possible that this is a fraudulent website.  Would you like me
>>>>     to invoke Safe Browsing Mode to prevent you from visiting a
>>>>     fraudulent site?"  The user could respond, Yes or No.
>>>>
>>>>     Some sort of artificial intelligence that could read and interpret
>>>>     email headers might be needed, possibly triggered by certain
>>>>     banking-like keywords or phrases in an email header.  I don't know
>>>>     if such exists, or if it does, whether it is "ready for prime
>>>>     time" and would produce reliable results.  But it might be one
>>>>     possible answer to the dilemma of needing to educate users to do
>>>>     certain things to protect themselves online.
>>>>
>>>>     At 08:25 AM 8/24/2007, Mary Ellen Zurko wrote:
>>>>
>>>>>         We have two sections in wsc-usecasee that touch on education:
>>>>>
>>>>>         http://www.w3.org/TR/wsc-usecases/#learning-by-doing
>>>>>
>>>>>         http://www.w3.org/TR/wsc-usecases/#uniformity
>>>>>
>>>>>         The first says that experience shows that while users learn,
>>>>>         education does not consistently produce the results desired.
>>>>>
>>>>>         The second cites on study that shows that education does not
>>>>>         impact susceptability to phishing. It's possible that
>>>>>         Brustoloni's latest shows that as well:
>>>>>
>>>>>         http://cups.cs.cmu.edu/soups/2007/proceedings/p88_sheng.pdf
>>>>>         is more hopeful, but shows no transfer to "realistic"
>>>>>         behavior, in a study or in the wild.
>>>>>
>>>>>         I gather from the discussions with the usability evaluation
>>>>>         folks, they believe they can address education.
>>>>>
>>>>>         Personally, I'm not a believer in direct education, mostly
>>>>>         because no one's brought up a single data point where users
>>>>>         were directly educated to do something, and did it, even when
>>>>>         they had options that were more attrractive for some reason
>>>>>         (e.g. more familiar, easier).  All the promising anti
>>>>>         phishing research makes sure that the secure option is the
>>>>>         most attractive (or at least comparably attractive).
>>>>>
>>>>>         On the other hand, I do believe that in circumscribed
>>>>>         oganizations, like the military and large companies, a system
>>>>>         of education, reward, and punishment can be (and is) set up
>>>>>         to change user behavior. I would again refer to
>>>>>         http://www.acsa-admin.org/2002/papers/7.pdf as showing an
>>>>>         upper bound on how successful that can be with the option is
>>>>>         not the most attractive (order of 30% of the overall
>>>>>         population).
>>>>>
>>>>>         I would be more comfortable with an education use case if we
>>>>>         said more somewhere about how we'll come to terms with it. Do
>>>>>         the usability evaluation folks know how we'll do that?
>>>>>
>>>>>                   Mez
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>         []
>>>>>         New Use Case for W3C WSC
>>>>>         Dan Schutzer to: public-wsc-wg
>>>>>             08/24/2007 07:52 AM
>>>>>
>>>>>         Sent by: public-wsc-wg-request@w3.org
>>>>>         <mailto:public-wsc-wg-request@w3.org>
>>>>>         Cc:"'Dan Schutzer'"
>>>>>
>>>>>
>>>>>
>>>>>
>> ------------------------------------------------------------------------
>>>>>
>>>>>
>>>>>         I'd like to submit a new use case, shown below, that several
>>>>>         of our members would like included. It looks for
>>>>>         recommendations on how to educate customers who have fallen
>>>>>         for a phishing email, and improve the type of response
>>>>>         customers generally get today when they try to access a
>>>>>         phishing site that has been taken down. I hope this is not
>>>>>         too late for consideration.
>>>>>
>>>>>         Use Case
>>>>>
>>>>>         Frank regularly reads his email in the morning. This morning
>>>>>         he receives an email that claims it is from his bank asking
>>>>>         him to verify a recent transaction by clicking on the link
>>>>>         embedded in the email. The link does not display the usual
>>>>>         URL that he types to get to his bank's website, but it does
>>>>>         have his bank's name in it. He clicks on the link and is
>>>>>         directed to a phishing site. The phishing site has been shut
>>>>>         down as a known fraudulent site, so when Frank clicks on the
>>>>>         link he receives the generic Error 404: File Not Found page.
>>>>>         Frank is not sure what has occurred.
>>>>>         Destination site
>>>>>
>>>>>         prior interaction, known organization
>>>>>         Navigation
>>>>>
>>>>>         none
>>>>>         Intended interaction
>>>>>
>>>>>         verification
>>>>>         Actual interaction
>>>>>
>>>>>         Was a phishing site that has been shut down
>>>>>         Note
>>>>>
>>>>>         Frank is likely to fall for a similar phishing email. Is
>>>>>         there some way to educate Frank this time, so that he is less
>>>>>         likely to fail for the phishing email again?
>>>>>
>>>>>
>>>>
>>>>
>>>> Content-Type: image/jpeg; name=9faa15.jpg
>>>> Content-ID: <7.1.0.9.0.20070824105938.01b6d470@bobpinheiro.com.1>
>>>> X-Attachment-Id: 0.1
>>>> Content-Disposition: inline; filename="9faa15.jpg"
>>>>
>>>
>> --
>> /*
>> Serge Egelman
>>
>> PhD Candidate
>> Vice President for External Affairs, Graduate Student Assembly
>> Carnegie Mellon University
>>
>> Legislative Concerns Chair
>> National Association of Graduate-Professional Students
>> */
> 
>    
> 
> 
> 
> 
> 
> 

-- 
/*
Serge Egelman

PhD Candidate
Vice President for External Affairs, Graduate Student Assembly
Carnegie Mellon University

Legislative Concerns Chair
National Association of Graduate-Professional Students
*/

Received on Friday, 24 August 2007 18:29:41 UTC