Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Firefox Microsoft

Firefox 2.0 Wins Phishfight Against IE7 181

Posted by Zonk from the hi-ya dept.
An anonymous reader writes "A new study that pitted the anti-phishing technology in Firefox 2.0 against that of IE7 generated some interesting results. From the Washingtonpost.com story: 'Firefox blocked 243 phishing sites that IE7 overlooked, while IE7 locked 117 sites that Firefox did not.' Microsoft responded by pointing to its own supposed comparison study that put it in front of Mozilla and others in phish fighting, but the story notes: '3Sharp, the company that authored the Microsoft study, clearly state on their site that their goal in creating 3Sharp was "to use the robustness, flexibility, and sheer native capabilities of the Microsoft communication and collaboration technologies to enhance the business of our customers."'"
This discussion has been archived. No new comments can be posted.

Firefox 2.0 Wins Phishfight Against IE7 More

Firefox 2.0 Wins Phishfight Against IE7

Comments Filter:

  • You have to consider... (Score:5, Interesting)

    by otacon ( 445694 ) on Tuesday November 14, 2006 @10:50AM (#16838300)
    that most phising sites are designed to circumvent Internet Explorer, since it is the most common internet browser, and practically the only browser for 'clueless' users, especially the ones that would be victims to a phishing site.

    • Re:You have to consider... (Score:5, Funny)

      by flyingsquid ( 813711 ) on Tuesday November 14, 2006 @10:56AM (#16838398)
      Also, should "www.firefox.com" and "www.mozilla.com" really be included in IE7's tally of phishing sites blocked?

    • Re: (Score:3, Interesting)

      by LiquidCoooled ( 634315 )
      I thought the aim of a phishing site was to circumvent the user?
      Its not specifically aimed to run a machine exploit (though some will involve overflowing the address bar), but to convince the user they are on a site they assume is safe.

      slashdot.com.au might get some folks others might be fooled by slashdot.info or some other variation (like the whitehouse.com former porn site).
      The attack vector is all in your head.

    • Re: (Score:2, Insightful)

      by frodo from middle ea ( 602941 )
      I never get this argument...
      If Linux/Firefox/(your favorite OSS product) was as popular as Windows/IE/(any proprietary Product), it will be attacked more, and will be equally vulnerable and would have equal # of security flaws.
      Fact is I don't care, What I want is something that is secure and really don't care if it is not as popular. In fact, "security by insignificance" works for me.

      • Re: (Score:2, Funny)

        by AdamKG ( 1004604 )
        Ok. Now- how would you explain away your homepage link?

      • Re:You have to consider... (Score:4, Insightful)

        by foamrotreturns ( 977576 ) on Tuesday November 14, 2006 @12:09PM (#16839644)
        No, you are dead wrong. Firefox gets patched more often, and since it is open source, that is the main reason that vulnerabilities are being found in it. Sooner or later, all the bugs in Firefox will be ironed out, and it will be considered bulletproof, while IE remains closed source and unavailable for third party code audits, which leaves it wide open to security breaches. Wouldn't you rather have a house that was built by one contractor and then inspected by thousands of others who were able to find and fix some issues with it than a house that was only inspected by the same contractor who built it? There is some correlation between popularity and number of exploits, but you make it sound like it's a 2-dimensional plane. It's not. There are other factors. The very same goes for Linux versus Windows. Until Windows and IE are open source, they will always be miles behind in security.
        BTW, security through insignificance is the same as security through obscurity, which is just a false sense of security. Just because something is out of the limelight does not mean that no one has the intention of messing with it.

        • Re:You have to consider... (Score:4, Insightful)

          by cosminn ( 889926 ) on Tuesday November 14, 2006 @01:00PM (#16840468) Homepage
          Sooner or later, all the bugs in Firefox will be ironed out, and it will be considered bulletproof

          You must be new to software engineering :) This will never happen with any software. The only way that would be possible is if you freeze the code, then ONLY fix bugs. Even then you have the possibility of creating a new bug from fixing a bug.

          That's never going to happen tho. And the more features you add, the more bugs you add, regardless of open/closed source.

          My problem is not that bugs exist, it's unavoidable, it's how they're handled that's important.

        • Re: (Score:3, Insightful)

          by owlstead ( 636356 )
          "Wouldn't you rather have a house that was built by one contractor and then inspected by thousands of others who were able to find and fix some issues with it than a house that was only inspected by the same contractor who built it?"

          Are you trying to be funny? Because I would never like to live in that first house. First of all, it would never get finished, disputes will break out and I would never get one ounce of peace. Fortunately, even with such hugely successfull applications, the number of real develo

        • sooner or later, all the bugs in Firefox will be ironed out, and it will be considered bulletproof

          Wrong, wrong, wrongedy wrong! There's always going to be another bug. The process of debugging itself adds more bugs. This is basic software engineering - you simply cannot assume that the software will be flawless.

          Can Firefox be made very, very secure? Yes. Is it already reasonably secure? Yes. Will it ever be 100% secure, never needing a single security patch? Not a chance.

          IE7 on Vista may not be the most sec

      • Re: (Score:2)

        by Firehed ( 942385 )
        Yes, Firefox/Linux/OSX/etc has security through obscurity going for it, but that doesn't mean it's not also actually more secure.

        Example: authentication in *nix-based OSes (including OS X) is required to modify system files or areas that could otherwise fuck up the computer. In XP, there's nothing. And in Vista, unless they changed it between RC2 and the RTM Gold Master, it's simply clicking 'allow'. If all you have to do is click, you won't read the thing - I very quickly found myself just randomly clic

    • Re: (Score:2, Insightful)

      by Trails ( 629752 )
      We're testing out new(ish) anti-phishing technology. At least, new enopugh that the argument that IE7 is the "incumbent" doesn't really hold unless the sites are exploiting leftovers from IE6. Then the point becomes obvious - if MS is pushing IE7's relative security over "previous browsers" (read: IE6), they should have fixed these holes.

  • MS will always struggle here (Score:5, Insightful)

    by Timesprout ( 579035 ) on Tuesday November 14, 2006 @10:52AM (#16838328)
    The risk of litigation inspired by false positives means they will always have to be a little more circumspect with who they classify as a phisher.

    • Re:MS will always struggle here (Score:5, Insightful)

      by LordSnooty ( 853791 ) on Tuesday November 14, 2006 @11:16AM (#16838722)
      And why couldn't someone sue the Mozilla Corporation and/or Foundation in the same circumstances?

      • Re: (Score:3, Insightful)

        by IDontAgreeWithYou ( 829067 )
        They could, but I imagine that it is slightly more lucrative to sue Microsoft.

      • Re: (Score:2, Insightful)

        by muukalainen ( 969833 )
        > And why couldn't someone sue the Mozilla Corporation and/or Foundation in the same circumstances?

        Probably because a) It's not a multi billion corporation with deep pockets and b) Because probably, being free, the application gives no warranties about the correctness of its phishing detection system, whereas c) In an American court, you can demand compensation for almost about everything, if you paid for a service; but if you didn't, probably you can't.
      • The anti-phishing blacklist is supplied by Google, or anyone else you want, AFAIK.

  • looks a lot like huhcorp (Score:1, Interesting)

    by Anonymous Coward
    That 3Sharp site [3sharp.com] look a lot like huhcorp [huhcorp.com].
    • ...The SmartWare site isn't much better. (SmartWare is the company that did the study the WP article is based on)

      See for yourself: http://www.smartware.com/
  • I suggest an improvement to Firefox 2.0. This refers to browsing an un-secure site. Currently, the "warning" icon that embeds itself in the location bar is not that visible. I suggest programmers introduce one that is clearly visible or change the color of the location bar background when such a site is hit.

    On the subject of phishing, I have not come across one, so my request is for a slashdotter to point me to an example so that I can check out one of Firefox's much hyped goodies. Thanks.

    • Re:A suggested improvement (Score:4, Informative)

      by LiquidCoooled ( 634315 ) on Tuesday November 14, 2006 @11:01AM (#16838492) Homepage Journal
      Its pretty hard to miss.

      Here is the hard-coded example of a phishing site from firefox: its-a-trap! [mozilla.com].

      The info is here [mozilla.com]
      • Thank you! You see, I had never hit a suspected phishing site before! Thanks once again.
        • Never get spam do you? Really?

          • Re: (Score:2, Insightful)

            by LiquidCoooled ( 634315 )
            I get spam but delete it without ever clicking.
            I've learnt never to click links or open attachments in unsolicited mails.

          • Re: (Score:3, Insightful)

            by ack154 ( 591432 )
            Never get spam do you? Really?

            I get spam all the time... but I too had never seen this thing before. Just because people get spam and phishing emails doesn't mean they're dumb enough to click them. I don't even do it out of curiosity.

    • Re: (Score:3, Insightful)

      by smooth wombat ( 796938 )
      I suggest programmers introduce one that is clearly visible or change the color of the location bar background when such a site is hit.

      The clearly visible one would be better since there are people who are completely color-blind (i.e. see things only in shades of gray) or who are color-blind to certain colors.

      A combination of what you suggest would be the most effective way of getting someones attention since it would be color-independent. Have the address bar flash between two different colored b

      • Just FWIW, color blindness is actually about not being able to percieve one of the colors in RGB: green, red or blue, in roughly this order of how widespread they are. People who percieve only shades of gray are not technically "color blind" and that condition is extremely rare. Not that it shouldn't be also considered, of course, it's just that it's VERY hard to come up with a color combination that will work well for ALL kinds of color blindness AND for normal people at the same time. So the best alternat

  • PhishFight! (Score:4, Funny)

    by Anonymous Coward on Tuesday November 14, 2006 @10:54AM (#16838366)
    /slap Microsoft

    * Anonymous Coward slaps Microsoft around a bit with a large trout.

    I win, I win!
    • IE7 is also incompatable with quickbooks 2004 and above. With the other problems I've heard of I have to ask why in the world is this POS being forced on users as a high priority security update?

      Intuit recommends uninstall. Just got that notice when I installed the latest QB update. Will Intuit learn from this? I've been reporting the bug of unable to run without power user (or higher user rights) in Betas for years.

  • Firefox, or IE7? (Score:3, Interesting)

    by smittyoneeach ( 243267 ) * on Tuesday November 14, 2006 @10:55AM (#16838384) Homepage Journal
    Firefox, or IE7?
    Which way finds one
    The phish-free heaven?
    Let browser, like foam
    Be lynx: sans leaven
    Burma Shave

  • It's really Google vs. Microsoft (Score:5, Informative)

    by SimplexO ( 537908 ) on Tuesday November 14, 2006 @10:57AM (#16838412) Homepage
    It's really Google vs. Microsoft because Firefox 2 essentially integrated Google's Safe Browsing extension [google.com] into the core browser. And while Firefox has the ability to change phishing-list providers (Tools -> Options -> Security), the only one it ships with is from Google.

    • Re: (Score:3, Informative)

      by LiquidCoooled ( 634315 )
      No, firefox ships with an automatically updating local database of phishing sites.
      You don't need to test every site with google, just use the built in one.

      Read more here [mozilla.com]

      • Re: (Score:2, Informative)

        by aitan ( 948581 )
        That list is currently provided only by Google, so the grandparent is right.
    • I thought one has a choice in Firefox preferences, one is to allow the browser to "download" a list of "known phishing sites" to use. The other is to allow Google to check each site the user goes to.
      In my livecd linux, I preset most of the preferences, and do not just provide the default Firefox setup.
      (See Screenshots, below)
      I decided to not use the "downloaded" list, since it was large, and probably going to get bigger. That list would then be part of my ~/.mozilla, in /ramdisk in a livecd linux. I
  • can't they be shut down? Can law enforcement make the ISPs shut down known phishing sites?
    • What do you have against bassmasters.com?

      • Re: (Score:1)

        by ack154 ( 591432 )
        What do you have against bassmasters.com?

        Well, for one, I don't hear or see a single bass guitar on that entire site! I mean, how can you be the master of something and not want to show it off?

    • Re:If these are known phishing sites... (Score:5, Informative)

      by jfengel ( 409917 ) on Tuesday November 14, 2006 @11:04AM (#16838542) Homepage Journal
      They come and go very quickly. Shutting something down legally is a tremendous hassle. You have to go to a judge and get a court order to do it. You have to find the ISP responsible for hosting it, assuming its in a jurisdiction you can get a hold of. You have to get the ISP to pay attention to you in the first place.

      It's probably a few hours of work, and then 30 seconds later the same site appears elsewhere. Marking it as "phishing" in a database doesn't have any due process protections, but it's not as severe as shutting it down.
      • This is where whitelisting would be useful. Warn people when a site they are visiting is less than two days old (and probably isn't in Google cache). Mail servers could add links from spam messages automatically to a temporary black list so that they get added much faster.

        That would reduce the effectiveness of most phishing sites to almost nothing.

        • Re: (Score:2)

          by laffer1 ( 701823 )
          It would also prevent litigation from false positives. On a white list setup, there wouldn't be a need to sue unless it was difficult to get a legit site added to the list. Then again, it might make attacking whitelisted sites more appealing.

      • Re: (Score:2)

        by Pastis ( 145655 )
        Caring ISPs are quick to react. Send an email to abuse@theisp.com after finding out who is hosting the server. They tend to be pretty quick in my experience...

        • Re: (Score:2)

          by jfengel ( 409917 )
          I suspect that most phishers these days are using the non-caring ISPs. There are plenty of them.

  • He mentions a whitelist. He must be joking. (Score:4, Interesting)

    by Viol8 ( 599362 ) on Tuesday November 14, 2006 @10:58AM (#16838430) Homepage
    The author of the piece suggests a whitelist must be more practical.
    Hmm , so that would mean checking against a list of a few billion web
    pages as opposed to a few hundred for the scam pages. Anyone spot the
    teensy problem? I do wish that just occasionally journos would have a
    small amount of knowledge in the area they're writing about.

    • Re:He mentions a whitelist. He must be joking. (Score:4, Informative)

      by Timesprout ( 579035 ) on Tuesday November 14, 2006 @11:05AM (#16838554)
      Actually he mentions a banking whitelist which is not a bad idea at all and not impractical to implement. In fact I can imagine in the future the banks will request this themselves as their liability incurred for customers duped by phishing scams increases.

      • Re: (Score:2)

        by qbwiz ( 87077 ) *
        Would there be a <banking> tag in the source, so that those pages will be checked? I suppose we'd have to mark every site that doesn't have that tag as phishing (with big flashing lights, of course), just so a phishing site doesn't try to pretend that it isn't banking.
      • The whitelisting is not such a bad idea. It certainly beats the blacklisting, which is inherently a stupid idea because you never end the race to keep the list updated.

        But why not take whitelisting the extra step and put it in the hands of the user? Allow the user to "flag" sites he goes to as good, and make the flag visually imposing in some manner. Or, even better, deduce if the site is one he usually visits from his browsing history and flag it automatically.

        And how about using Bayesian statistics to com

    • Re: (Score:3, Funny)

      by mattwarden ( 699984 )

      I do wish that just occasionally journos would have a small amount of knowledge in the area they're writing about.

      Yeah, and I wish vicodin wasn't prescription-only. Talk about pie-in-the-sky!

    • Re: (Score:3, Interesting)

      by Bill Dimm ( 463823 )
      First, it would be a list of domain names rather than webpages, so millions instead of billions. Second, it is only really important to whitelist sites where sensitive information is entered (banks, sites taking credit cards, etc.), so even fewer sites. Finally, the browser could cache the lookup results for the sites you've visited in the past, so it would only need to do a lookup when you visit a site you haven't been to before, like when you accidently go to mybanc.com when you should be at mybank.com.

      • Re: (Score:2, Informative)

        by jrsp ( 513795 )
        And now virus makers and phishers team up to hack your local copy of "safe" sites. "Why yes, young man, www.sitibank.com IS the right address."

        The problem, as always, is trusting the data. If you request it from a known source via a secure channel you're good. Once you save it you expose it to other attacks.
        • The problem, as always, is trusting the data. If you request it from a known source via a secure channel you're good. Once you save it you expose it to other attacks.

          If you have a virus on your computer, what keeps it from routing all TCP/IP traffic through a proxy to intercept the transmissions to the secure channel? What keeps it from modifying the browser executable to cut out the phishing check? What keeps it from keylogging your password when you visit a legitimate banking site? If you've got a viru

  • Opera? (Score:2, Interesting)

    by elcid73 ( 599126 )
    I didn't RTA, nor do I have OPera's 9.1TP installed with fraud protection, but I'd be interested in how it fares.

  • Phishfight (Score:4, Funny)

    by digitaldc ( 879047 ) * on Tuesday November 14, 2006 @11:00AM (#16838476)
    And I thought a Phishfight is what happens after you criticize Trey for falling off his trampoline during a 'smokin' rendition of 'You Enjoy Myself'

  • That's probably the first time... (Score:5, Funny)

    by petrus4 ( 213815 ) on Tuesday November 14, 2006 @11:06AM (#16838580) Homepage Journal
    ...I've honestly ever seen the words "robust," and "Microsoft," in the same sentence.
  • So clearly the best idea is to visit each site you visit using BOTH browsers so one will likely catch the phishing mechanism! Ah, safety has never been so simple!

  • Firefox antiphising is far from perfect... (Score:5, Interesting)

    by diegocgteleline.es ( 653730 ) on Tuesday November 14, 2006 @11:11AM (#16838646)
    ...at least until they fix bug #356355 , which "jumps" the antiphising filter

    fe, if you go to http://200.119.135.99/ebay/login5878/ [200.119.135.99] the pishing filter will warn you

    but if you encode the IP with a unusual encoding

    http://0xc8.0x77.0x87.0x63/ebay/login5878/ [0x77.0x87.0x63]

    the phising filter will not kick in

  • Conspiracy time (Score:2, Insightful)

    by ChubZee ( 855708 )
    This seems to me like another bonus for Google and Microsoft in tracking users browsing habits. If every time someone visit a site using FF2.0 or IE7 it 'phones home' to find out of the page is a phishing site or not, won't these companies be able to build a more concise and accurate profile of web users? Just a thought...

  • False Positives? (Score:4, Insightful)

    by aardwolf64 ( 160070 ) on Tuesday November 14, 2006 @11:31AM (#16838958) Homepage
    As the article points out, false positives were not addressed at all in this study. Without testing for false positives, those numbers are useless. If Firefox listed 100% of websites as phishing sites, the fact that it caught more than IE7 isn't all that impressive.

  • They don't look for the obvious (Score:4, Interesting)

    by cvd6262 ( 180823 ) on Tuesday November 14, 2006 @11:49AM (#16839310)
    I teach a college course for teaching majors. Each year I do a phishing demonstration where I post a bunch of links on my blog, including one to the university's intranet. The links are all full paths (http://...), but the href in the intranet link points to a different server. When the students try to login, they get a message about phishing.

    This semester I was a bit worried because I had heard IE 7 had new "anti-phishing technology." I thought IE would obviously check the text of the link against the target address, but that didn't happen. FireFox 2 doesn't either.

    How hard would it be to check the text of a link against a regex for urls, then, if it is a url, check that the target is the same?
  • A phishfight is ..

    - When two philosophers fight each other with fishing rods
    - A trout slapping competition in Greece
    - What happens when a dolphin with a slight identity crisis gets fed-up with hearing the other dolphins sing Batman
    - A form of violence between spelling-challenged fishmongers in an open air market. ...

  • Haiku (Score:2)

    by db32 ( 862117 )
    Which browser to use
    Red fox globe or big blue E
    so long thanks for all the phish
  • their site that their goal in creating 3Sharp was "to use the robustness, flexibility, and sheer native capabilities of the Microsoft communication and collaboration technologies to enhance the business of our customers."'"

    So let me get this right, the company is bad because they use MS products while testing MS products? Hmm...

    So how does SlashDot suggest a company test MS products without using them?

    Ok, just because a company USES MS products does not mean they are biased. They could be, but they also cou
  • Microsoft maintains there on database of phishing sites and they are focused on reducing False Positives. It is still relativly new.

    If a bank is falsely blocked by Firefox they will simply tell users to use IE.

    If IE falsely blocks a bank site they would simply sue Microsoft.

    Both browser still have a margin of error of 20-40%. While IE blocks some that FireFox misses, FireFox blocks some that IE misses. Firefox is doing better, but I wouldn't say they are winning yet.

Slashdot Top Deals

God made the integers; all else is the work of Man. -- Kronecker

Close