Protecting (even) Naïve Web Users, or: Preventing Spoofing and Establishing Credentials of Web Sites

Abstract

In spite of the use of standard web security measures, swindlers often clone sensitive web sites and/or present false credentials, causing substantial damages to individuals and corporations. We believe that, to large extent, this is due to the difficulty of noticing when a sensitive web page has incorrect location or is simply unprotected. In fact, we show that several of the largest web sites, ask users for passwords in unprotected pages, making them easy targets; apparently, even the designers did not notice the lack of protection. Several papers presented web spoofing attacks, but mostly focused on advanced attacks trying to mislead even a careful expert; some also suggested countermeasures, mostly by improved browser user interface. However, we argue that these countermeasures are inappropriate to most non-expert web users; indeed, they are irrelevant to most practical web-spoofing attacks, which focus on naive users. In fact, even expert users could be victim of these practical, simple spoofing attacks, resulting in identity theft or other fraud. We present the trusted credentials area, a simple and practical browser UI enhancement, which allows secure identification of sites and validation of their credentials, thereby preventing web-spoofing, even for nave users. The trusted credentials area is a fixed part of the browser window, which displays only authenticated credentials, and in particular logos, icons and seals. In fact, we recommend that web sites always provide credentials (e.g. logo) securely, and present them in the trusted credentials area; this will help users to notice the absence of secure logo in spoofed sites. This follows the established principle of branding. Logos and credentials may be certified by trusted Certificate Authorities, or by pee...