Shostack + Friends Blog Archive

More on Using Email Like a Stupid Person

[Update: A less in-your-face version is Preserving the Internet Channel Against Phishers.]

There have been lots of good comments, both here and over at Nielsen Hayden’s Making Light. There’s a few points left dangling that I wanted to respond to further. Those are the “ignore the marketing department” view and the “train the customer view.” Clifton Royston (who also points to the “Phish or Phair” comparison site) sums up the first as:

So, if I may sum up, all that is needed is: to individually convince the management of thousands of banks and financial institutions across the United States to entirely ignore their marketing departments (who want to send HTML mail) and pay attention only to security specialists

That’s certainly one way to look at it. I think that the management of most large institutions is aware of the phishing problem, and they, along with their marketing departments know that they need to find a solution or risk losing the online channel. The alternative to solving the problem promptly is that more customers will do exactly what Eleanor does, and refuse to give an email address at all. So I don’t believe that this has to be “security versus marketing,” if security markets their suggestions better than calling marketing stupid people.*

The other point raised is skepticism over my suggestion “Train your users to expect short and simple messages.” Several folks point out that training end-users is hard. They are entirely correct. What I meant is regular, repeated messaging like the following:

For your safety online please bookmark BigBank. We will never ask you to click on a link, or send you flashy email. We will send you short notes when we need to communicate with you, asking you to login with your regular bookmark. Because con men have gotten so good at pretending to be us, we will always be brief and simple looking.

Clearly, that wording could use some work, but that’s the essence of what I suggest. With repetition and reinforcement, we could see phishing fall off. I have no complete answer to Josh D’s point about courier formatted HTML mail, except, “Use your bookmarks, Don’t click on links.”

One final question: I read somewhere an interesting analysis of Passmark usability.
(Passmark’s idea is that the bank and you share a picture, which the real bank will show you when you’re about to log in. The core of the analysis was that that happens in enough different ways that an attacker may be able to game it.) Is this familiar to any readers, and if so, can you tell me where it was? I’ve searched and come up blank. [Jason Axley points to David Cowan].

* With 20:20 hindsight, that was a dumb title for my posts: Calling the people who need to change “stupid” is a stupid way to start.

Originally published by adam on 15 Aug 2005
Last modified on 15 Aug 2005
Categories:   information security   Uncategorized