Does domain highlighting help people identify phishing sites?

Phishers are fraudsters that mimic legitimate websites to steal user’s credential information and exploit that information for identity theft and other criminal activities. Various anti-phishing techniques attempt to mitigate such attacks. Domain highlighting is one such approach recently incorporated by several popular web browsers. The idea is simple: the domain name of an address is highlighted in the address bar, so that users can inspect it to determine a web site’s legitimacy. Our research asks a basic question: how well does domain highlighting work? To answer this, we showed 22 participants 16 web pages typical of those targeted for phishing attacks, where participants had to determine the page’s legitimacy. In the first round, they judged the page’s legitimacy by whatever means they chose. In the second round, they were directed specifically to look at the address bar. We found that participants fell into 3 types in terms of how they determined the legitimacy of a web...

• Type: Journal
• Year: 2011
• Where: CHI
• Authors: Eric Lin, Saul Greenberg, Eileah Trotter, David Ma, John Aycock
• Keywords: CHI 2011, Fraudsters, Human Computer Interaction, Legitimacy, Sole Method