Basically, have a one-character rolling hash of the domain plus the password next to a password field. So, when the user has finished typing their password, it functions like a check digit. If they are on a different domain, it's pretty likely (depending on the number of different characters; we could easily have 26 + 26 + 10 - a few confusables) that the checksum character would be different. Hopefully, this would be a cause for alarm.
Because it also helps with the problem, we could push it as a "avoid password mistyping" feature, to try and get people to check the checksum character before submission.
Advantages:
- Another visual difference between a genuine site and a phishing site - Helps people to notice that they've mistyped their password
Disadvantages:
- Requires fairly significant user education - Can't help if people finish typing and immediately hit enter - Extra UI; possibly confusing and intrusive - Theoretical danger of shoulder-surfers working out first few letters of password
What do people think?
Gerv _______________________________________________ Mozilla-security mailing list [email protected] http://mail.mozilla.org/listinfo/mozilla-security
