why 'safe site' indicators fail

there's been some interest lately in a study on the efficacy of various 'safe site' indicators such as HTTPS and website authentication images... these are indicators that are supposed to help the user determine that it's safe for them to enter their credentials, that it isn't a phishing site, but according to the study those indicators don't work (or rather their absence isn't enough to tell people that a site isn't safe)...

let's look at why... website authentication images (where you select an image to be shown on future visits to prove that the site is the same one you initially visited - essentially a visual shared secret authentication protocol) are a pretty new development, their use (and their significance) has probably not yet reached the mainstream among users... as such slip ups might be forgiven (if you could attribute a near 100% failure rate to mere slip ups)... maybe websites are just too unreliable when it comes to displaying images - perhaps we've come to expect images to be absent on occasion...

HTTPS indicators (that indicates you're visiting a secure site, that your session is encrypted with SSL or TLS) on the other hand have been around for quite some time... they've become about as mainstream in the publics awareness as they're going to get so their complete failure can't be blamed on it's novelty - perhaps they're just too unobtrusive?

the only one that had a significant impact was actually an unsafe site indicator (a warning that came up when visiting a site that wasn't safe)... now, aside from the interesting implications all this may have for why humans seem to more naturally lean towards blacklists, the relative success of these 2 types of indicators (safe or unsafe) brought to mind a little tidbit about human perception i heard some time ago... it seems that we're much better at noticing when something that shouldn't be there is there than we are at noticing when something that should be there isn't...

put another way:

The opposite to this effect is a situation where the brain perceives something that is not actually there. On being presented with an incomplete object, the brain automatically fills in the missing pieces according to our previous memory and experience. There are many examples available of common optical illusions to illustrate this.

this more than adequately explains why the absence of safe site indicators would be ignored by people, and in so doing shows why such human-interpreted safe site indicators aren't (and won't be) effective at warning people away from phishing sites...

(and yes, i realize the implications this has for my manual phishing email detection method - i can only hope that our tendency to pay attention to who sends the emails we receive makes share secret authentication as a way to weed out phish more workable in an email context than it is on the web...)

how to recognize phishing emails the easy way

perhaps you've seen this phishing iq test before... if not, that's ok - it's basically a bunch of examples of legitimate emails and phishing emails and you have to try and figure out which are which... the root concept is that there are these heuristics or rules of thumb that you can apply so as to determine whether a particular email is phishy just by looking at it...

the fact that browsers now come with anti-phishing technology built in that tries to identify a phishing site just by looking at the URL is strong evidence that those rules of thumb for detecting phishing emails are a failure but take the test and look at some of those rules at the end and see if you can determine why those rules aren't going to work... if you ask me, those rules are just too complex for the average person to remember or apply... add to that the fact that the characteristics of a legitimate email are possible in phishing emails (for example, ebay starts their emails to you with your ebay user name but anyone who has interacted with you on ebay knows that user name and thus has the information necessary to make a convincing fake ebay email)... finally take into account that legitimate emails often display phishy characteristics (both in the test, where only one of the emails was completely free of phishy characteristics, and in this real world example) and it becomes clear that not only are the rules complex but they're pretty much completely unreliable too...

after getting through that test, if you're like me you're probably saying to yourself "there must be an easier way"... so you can imagine how glad i am that i don't need to try to remember and follow those screwy rules... instead, i do something i touched on in my spam avoidance article - i use disposable email addresses... now, while the spam avoidance techniques actually apply to pretty much all forms of email annoyance (if the bad guys don't know your email address they can't send you bad email), i'm actually talking about more than just keeping my email address out of the hands of phishers, something that works even when your real email address is known to the bad guys... i use unique (a different one for each site) unguessable disposable email addresses provided by sneakemail.com and then when i get an email from ebay or paypal or my bank i check and make sure that it was sent to the right address for that organization...

here's how the magic works - let's say i create an address like mgbwklw02@sneakemail.com and give that address to ebay and no one else... the address is a secret that only ebay and myself know and no one else can guess so when i get an ebay email sent to that address i'll know that it was sent by ebay because they proved who they were by using a secret known only to ebay and myself... it's like knowing the secret passphrase or handshake to get into an exclusive club (or, more technically, it's like a shared secret authentication protocol)... alternatively, if i get an email supposedly from ebay but sent to some other email address i'll know it's fake because it was sent to some address that i never gave to ebay in the first place... if someone really, really wanted to send me a convincing fake ebay email they would have to either guess exactly the right email address to send to or guess the label i gave my ebay address (sneakemail.com allows you to label your disposable addresses and includes the that label in the From: field to help you determine which address the email was sent to) and try to forge a sneakemail.com header...

could using unique unguessable disposable email addresses for sites/organizations and ignoring emails sent to the wrong address for the site/organization in question qualify as an anti-phishing safe hex rule? i think so... although it requires a little more work up front (creating a new address each time you create an account somewhere), it's conceptually simpler than the multitude of rules currently being suggested and it's a lot more reliable too since it doesn't depend on questionable criteria such as how the email was composed...