TrustBar: Protecting (even Naïve) Web Users from Spoofing and Phishing Attacks

In spite of the use of standard web security measures (SSL/TLS), users often fail to detectspoofedweb forms, and enter into them sensitive information such as passwords. Furthermore, users often access the spoofed sites by following a link sent to them in a (fraudulent) e-mail message; this is calledphishing`. Web spoofing and phishing attacks cause substantial damages to individuals and corporations. We analyze these attacks, and identify that most of them exploit the fact that users are not sufficiently aware of the secure site identification mechanisms in browsers. In fact, it appears that even web designers are often confused about the need to securely identify login forms; we show several sites that prompt users for passwords using unprotected forms. We derive several secure user interface principles, and present TrustBar, a secure user interface add-on to browsers. For protected web pages, TrustBar identifies the site and the certificate authority, using logos or at least names (rather than URL). For unprotected pages, TrustBar displays highly visible warnings. Early experimental results indicate that these mechanisms provide substantial protection, even for naive and off-guard web users, from spoofing/phishing attacks.