> On Oct 2, 2019, at 1:16 PM, Ronald Crane via dev-security-policy > <dev-security-policy@lists.mozilla.org> wrote: > > On 10/1/2019 6:56 PM, Paul Walsh via dev-security-policy wrote: >> New tools such as Modlishka now automate phishing attacks, making it >> virtually impossible for any browser or security solution to detect - >> bypassing 2FA. Google has admitted that it’s unable to detect these phishing >> scams as they use a phishing domain but instead of a fake website, they use >> the legitimate website to steal credentials, including 2FA. This is why >> Google banned its users from signing into its own websites via mobile apps >> with a WebView. If Google can prevent these attacks, Mozilla can’t. > > I understand that Modlishka emplaces the phishing site as a MITM. This is yet > another reason for browser publishers to help train their users to use only > authentic domain names, and also to up their game on detecting and banning > phishing domains. I don't think it says much about the value, or lack > thereof, of EV certs. As has been cited repeatedly in this thread, most > phishing sites don't even bother to use SSL, indicating that most users who > can be phished aren't verifying the correct domain.
[PW] Ronald, I don’t believe better detection and prevention is the answer for anti-phishing - but not trying isn’t an option, obviously. With billions of dollars being invested in this area, and with hundreds of millions changing hands through M&A every year, the problem is getting worse. Every week we read about yet another security company with anti-phishing [insert fancy words here]. It’s ain’t work’n. I believe I demonstrated in a previous message, with data and techniques, why it’s impossible for any company to detect every phishing URL or website. And I’m afraid you’re incorrect about SSL certs. According to Webroot, over 93% of all new phishing sites use an SSL certificate. And according to MetaCert it’s over 95%. And of those with a DV cert, over 95% come from Let’s Encrypt - because they’re automatically issued for free and they have a near-zero policy for detection, prevention or cert revocation. This is why over 14,000 SSL certs were issued by Let’s Encrypt for domains with PayPal in it - so if you believe in better detection and prevention, why don’t you/we request this of Let’s Encrypt? Why isn’t anyone’s head blowing up over the Let’s Encrypt stats? If people think “EV is broken” they must think DV is stuck in hell with broken legs. It’s impossible to properly verify the domain by looking at it - you need to carry out other checks. It’s simply not solving the problem. I provided data and insight to how website identity UI can work - I’d really love to hear counterarguments around that, or agreement that it’s useful. - Paul > > -R > > > _______________________________________________ > dev-security-policy mailing list > dev-security-policy@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-security-policy _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
