The battle against phishing: Dynamic Security Skins

Phishing is a model problem for illustrating usability concerns of privacy and security because both system designers and attackers battle using user interfaces to guide (or misguide) users. We propose a new scheme, Dynamic Security Skins, that allows a remote web server to prove its identity in a way that is easy for a human user to verify and hard for an attacker to spoof. We describe the design of an extension to the Mozilla Firefox browser that implements this scheme. We present two novel interaction techniques to prevent spoofing. First, our browser extension provides a trusted window in the browser dedicated to username and password entry. We use a photographic image to create a trusted path between the user and this window to prevent spoofing of the window and of the text entry fields. Second, our scheme allows the remote server to generate a bstract image for each user and each transaction. This image creates a “skin” that automatically customizes the browser window or the...

• Type: Conference
• Year: 2005
• Where: SOUPS
• Authors: Rachna Dhamija, J. Doug Tygar
• Keywords: Image, SOUPS 2005, User, User Interface