Over at the EMT Blog, jterrill seems to be suggesting that browser makers give up on protecting users from phishing. Well, I'm not ready to give up and neither are the tens of thousands of people working to make Firefox better with every release.
The main argument jterrill is advancing seems to be that none of the three main anti-phishing techniques are completely effective so by offering them to users, we are giving them a false sense of security.
To make the case, he looks at the tree primary anti-phishing techniques and calls them each ineffective.
The first, and currently the most effective approach that the browsers have implemented to prevent phishing is blacklisting. With this approach, the browser compares the site the user is visiting (or about to visit) to a list of known bad sites. jterrill suggests that this can't possibly be effective because the bad guys are creating and using new sites at an alarming and increasing rate. My response to this criticism is pretty simple: without some evidence that the blacklists aren't also advancing at a similarly increasing rate, this doesn't tell us anything about the efficacy of blacklists. As the bad guys get faster at creating and advertising new sites, the blacklists are going to have to advance faster. Until it's demonstrated that cannot happen, something that jterrill hasn't done, this approach will continue to be extremely valuable in protecting users and we'll continue to employ it.
The second approach is pattern matching where heuristics are developed to catch the most common patterns used in phishing attacks. This is a new area for phishing protection but has been used with some efficacy in anti-spam email systems. I can't find jterrill's argument against this approach (unless he's suggesting that the this approach is limited to URL analysis) and his example seems a bit simple to me. But, as I said, this approach has a lot of room to grow (see CANTINA) and while the initial implementation we've seen in IE7 isn't doing very much, future implementations that take into account much more of the page content could become very effective in for many phishing cases.
The final approach that jterrill discounts is whitelisting. In this system the browser compares the site a user is about to visit to a list of known good sites and only allows the visit to happen if the site is on the known good list . jterrill's argument against this approach is that sites are not only impersonated but can also be compromised. He argues that a compromised, whitelisted site is the worst kind of failure. I don't see this as necessary. It would depend on what the actual user experience was in the browser. If the browser tells users that they are always 100% safe when visiting a whitelisted site, yes, that would be bad. If, however, whitelisting was just one of several layers of defense against phishing, and users weren't given false safety guarantees, then this problem is no worse than failures of the blacklist and the heuristic methods. One additional note here is that compromising major services like banks and ecommerce sites is much harder than setting up a phishing site that simply tries to impersonate the real thing. These attacks are going to be few and far between making the whitelist approach a very effective tool in the most common use cases.
But in analyzing each of these three tactics and concluding that we're all doomed, jterrill seems to be missing a few key points. First, while any of these may not be 100% effective, preventing more phishing successes is better than preventing no (or fewer) phishing successes and each one of these approaches can have a dramatic impact on the success rates. Second, these approaches don't have to be used in isolation. Multi-layered approaches offer a security in depth that can be considerably more effective than any one approach alone. And finally, jterrill seems to assume that these are the only three approaches available or possible, ignoring other solutions that are being developed or are already deployed, like petname systems and dynamic security skins, two-factor authentication, EV certs, and finally, improved browser user interfaces.
This is no doubt going to be a lont-term arms race, but I'm not ready to give up. To the contrary, I think that if browser makers continue to focus on this, we can kick some phishing butt and I'm looking forward to that!