Re: Suggestion to HTML form element to compat phishing

On Thu, May 25, 2006 at 04:56:34AM +0200, Ka Cheung Sia wrote:
> As we know, phishing activities are very active in the Internet
> nowadays. Such vulnerability of phishing is partly because we allow a
> user's password to be sent in its plain format to the server side; it
> makes the phishers able to collect username and password by setting up a
> fradulent website that looks like a legitimate one and tempt the user to
> input their secret information.

The ability of criminals to create a site that appears to be a
different site has nothing to do with sending passwords in the clear.


> I am suggesting to add a new attribute within the HTML input element
> to improve what we are currently using (<input type="passowrd"/>)
> for password input. The new attribute will be something like (<input
> type="challenge" param="some random string" value="......>). The
> broswer will render this as a password box similar to what we get
> right now, but when sending out the data, it uses the value input by
> the user to encrypt the random string and send it back to the
> server.

So the client would hash the password and send the hashed password to
the pishers.

The pishers could then construct an HTTP request using the hashed
password they recieve and send it to the site the user thought they
were communicating with.

> As you can see, the idea here is to avoid sending the password in it's
> plain format to the server; instead, it is used to encrypt a string.
> Given a corresponding changes in the server side to generate random
> string with proper timeout period when user access their login page, and
> use the same encryption/decryption mechansim to check against the
> password, phishers can no longer harvest plain password but an encrypted
> form of it. 

Dealing with timeouts is simple - the pisher just grabs the form from
the real site, passes the key to the user, gets the hashed version
back, then immediately logs into the real site and empties the account
(or whatever).

Alternatively they construct the form using current HTML so the user
enters their password and they get the clear password, then they can
hash it every time the target site issues a new key.

> This new HTML input attribute can guard against phishing
> activites nowadays to certain extent. How do everyone feel about this
> addition?

Ineffective.

-- 
David Dorward                                      http://dorward.me.uk

Received on Tuesday, 30 May 2006 09:41:21 UTC