- From: Thomas Roessler <tlr@w3.org>
- Date: Mon, 22 Jan 2007 15:46:15 -0500
- To: public-wsc-wg@w3.org
http://www.usablesecurity.org/papers/jackson.pdf An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks Collin Jackson1, Daniel R. Simon2, Desney S. Tan2, and Adam Barth1 Abstract. In this usability study of phishing attacks and browser antiphishing defenses, 27 users each classified 12 web sites as fraudulent or legitimate. By dividing these users into three groups, our controlled study measured both the effect of extended validation certificates that appear only at legitimate sites and the effect of reading a help file about security features in Internet Explorer 7. Across all groups, we found that picturein- picture attacks showing a fake browser window were as effective as the best other phishing technique, the homograph attack. Extended validation did not help users identify either attack. Additionally, reading the help file made users more likely to classify both real and fake web sites as legitimate when the phishing warning did not appear. Cheers, -- Thomas Roessler, W3C <tlr@w3.org>
Received on Monday, 22 January 2007 20:45:16 UTC