Evaluating a trial deployment of password re-use for phishing prevention

ACM International Conference Proceeding Series

Volumn 269, Issue , 2007, Pages 26-36

  Florencio, Dinei ^a   Herley, Cormac ^a  

^a MICROSOFT RESEARCH   (United States)

Author keywords

access control; authentication; passwords; phishing

Indexed keywords

FALSE POSITIVE; LOW LATENCY; PASSWORDS; PHISHERS; PHISHING; PREVENT INFORMATION LEAKAGE;

AUTHENTICATION; SECURITY SYSTEMS;

SECURITY OF DATA;

EID: 67249093944     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1299015.1299018     Document Type: Conference Paper

References (30)

1. http://www.rsasecurity.com.
2. http://www.scamblocker.com.
3. http://www.spoofstick.com.
4. http://www.passmarksecurity.com.
5. B. Adida, S. Hohenberger, and R. L. Rivest. Fighting phishing attacks: A lightweight trust architecture for detecting spoofed emails. USENIX Steps to Reducing Unwanted Traffic on the Internet Workshop (SRUTI).
6. N. Chou, R. Ledesma, Y. Teraguchi, D. Boneh, and J. Mitchell. Client-side defense against web-based identity theft. Proc. NDSS, 2004.
7. M. Delany. Domain-based email authentication using public-keys advertised in the dns. 2004. http://www.ietf.org/internet-drafts/draft-delany-domainkeys- base-01.txt.
8. R. Dhamija and J. D. Tygar. The battle against phishing: Dynamic security skins. Symp. on Usable Privacy and Security, 2005.
9. Federal Trade Commission. Identity Theft Survey Report. 2003. http://www.ftc.gov/os/2003/09/synovatereport.pdf.
10. D. Florêncio and C. Herley. A Large-Scale Study of Web Password Habits. WWW 2007, Banff.
11. D. Florêncio and C. Herley. Stopping a Phishing Attack, Even when the Victims Ignore Warnings. MSR Tech. Report TR-2005-142, 2005.
12. D. Florêncio and C. Herley. Analysis and Improvement of Anti-Phishing Schemes. SEC, 2006.
13. D. Florêncio and C. Herley. Password Rescue: A New Approach to Phishing Prevention. Proc. Usenix Hot Topics in Security, 2006.
14. E. Gaber, P. Gibbons, Y. Matyas, and A. Mayer. How to make personalized web browsing simple, secure and anonymous. Proc. Finan. Crypto '97.
15. W. Gale. Good-Turing Smoothing Without Tears. Statistics Research Reports from AT&T Laboratories 94.5, AT&T Bell Laboratories, 1994.
16. J. A. Halderman, B. Waters, and E. Felten. A convenient method for securely managing passwords. Proceedings of the 14th International World Wide Web Conference (WWW 2005).
17. A. Herzberg and A. Gbara. Trustbar: Protecting (even naive) web users from spoofing and phishing attacks. 2004. http://eprint.iacr.org/2004/155.pdf.
18. M. Jakobssen and A. Young. Distributed phishing attacks. 2005. http://eprint.iacr.org/2005/091.pdf.
19. Jefferson Wells Inc. Microsoft Phishing Filter Feature in Internet Explorer 7 and Windows Live Toolbar. 2006. http://www.jeffersonwells.com/client- audit-reports/Microsoft-PF-IE7-IEToolbarFeature-Privacy-Audit-20060728.pdf.
20. J. Kelsey, B. Schneier, C. Hall, and D. Wagner. Secure applications of low-entropy keys. Lecture Notes in Computer Science, 1396:121-134, 1998.
21. P. Oorschot and S. Stubblebine. Countering identity theft through digital uniqueness, location cross-checking, and funneling. Financial Cryptography, 2005.
22. Anti-Phishing Working Group. http://www.antiphishing.org.
23. B. Ross, C. Jackson, N. Miyake, D. Boneh, and J. C. Mitchell. Stronger password authentication using browser extensions. Proceedings of the 14th Usenix Security Symposium, 2005.
24. M. E. Russinovich and D. A. Solomon. Microsoft Windows Internals. Microsoft Press, fourth edition, 2005.
25. S. Schechter, R. Dhamija, A. Ozment, I. Fischer. The Emperor's New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies. IEEE Security & Privacy, 2007.
26. M. Sahami, S. Dumais, D. Heckerman, and E. Horvitz. A bayesian approach to filtering junk email. Learning for Text Categorization, 1998.
27. B. Schneier. Applied Cryptography. Wiley, second edition, 1996.
28. M. Wu, R. Miller, and S. L. Garfinkel. Do Security Toolbars Actually Prevent Phishing Attacks. CHI, 2006.
29. M. Wu, R. Miller, and G. Little. Web Wallet: Preventing Phishing Attacks by Revealing User Intentions. SOUPS, 2006.
30. K. Yee and K. Sitaker. Passpet: Convenient Password Management and Phishing Protection. SOUPS, 2006.