353922 - History-based anti-phishing mechanism

Status: RESOLVED WONTFIX

(Toolkit :: Safe Browsing, enhancement)

Description

[Tal Cohen]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7

A suggestion for a new (additional) anti-phishing mechanism, that does not rely on blacklisting but rather on client-side, automatic whitelisting.

In a nutshell: Whenever a password form is submitted, the browser should check if the user had previously logged onto this site. If not, a clear warning should be displayed prior to sending the HTTP request with the password.

Technical details:

Every time the user visits a website and submits a password-form, the browser remembers it. This is not maintained as part of the history, and not deleted when browsing history is deleted. To maintain privacy, the list of visited sites does not actually contain the domain names, but rather a cryptographic hash thereof. Thus, we can verify if a specific site is in the whitelist, but there is no easy way to obtain a list of visited sites. Still, for the extra-paranoid, a special menu option will be avilable for deleting the whitelist.

When a user submits a password form to a site that was not whitelisted, a warning window will appear. The window will contain a brief explanation, a link to more detailed information about phishing, and mainly the question: "Are you sure you wish to submit a password to DOMAIN-NAME?"

It is important that DOMAIN-NAME will be presented in all-uppercase using a serif font; this will help distinguish, e.g., PAYPAI from PAYPAL (if you're using a sans-serif font, the following could be indistinguishable: paypaI and paypal).

Finally, for easier migration and a better user experience, the whitelist can be populated initially from one or more of the following sources:
1. When FF is upgraded from a previous version, without this mechanism: initialize the list based on the browser history.
2. Likewise when FF is installed on a machine with IE.
3. Pre-populate the list with known valid sites that are common phishing targets (reputable online stores, Paypal, banks, etc.)


Reproducible: Always

Comment 1

[Jesse Ruderman]

I recommend wontfix, mostly because Firefox cannot tell whether a malicious page "looks like a password form".  Treating only <input type="password"> as a password field won't work, because a malicious site could make something else that looks like a password form.

Also, this would be more of a privacy risk than you think.  Storing hashes rather than hostnames doesn't help much; someone with access to the hashes could easily compare against a list of the 10000 most popular web sites.

Trusting sites that you've visited before is an interesting idea, but this isn't the right way to do it.

Comment 2

[Tal Cohen]

Re: Comment #1

Regarding the privacy risk, the list can be hashed with a salt, generated per FF installation. This solves the problem of pre-hashed lists. Also, the default list (which ships with FF) could contain in advance a rich list of thousands of known, popular, legitimate sites, which will be re-hashed during installation.

Detecting password forms is indeed nontrivial. I suggest a "better safe than sorry" approach: any form with a type=password field, as well as any form which uses JavaScript, Flash, etc. or even an input field with non-default colors (so that a password-like field can be faked). Assuming the pre-provided site list will indeed be rich (10,000 most popular web sites, per your suggestion) the nuisance will be minimal -- once per non-common web site.

Comment 3

[Tony Chang (Google)]

I would suggest demonstrating this idea's usefulness via an extension first.

Comment 4

[mozilla3eran]

Salting the cryptographic hash doesn't help much, when it's a trivial effort to compute a few thousand (or million, for that matter) hashes.

With your "better safe than sorry" approach, most websites created in this millenium will cause a warning the first time you visit them; and I'm sure phishers will still find a way around it.

A different approach is to check everything the user types against his stored passwords, and warn him if he typed into domain X a password that was previously entered into some other domain but never yet into domain X. By that point it may be too late (site X could have used JavaScript to grab the password before the user submitted the form), but at least the user gets some indication of trouble and can change his password in the legit site. This also has the welcome side effect of warning users when they use the same password in multiple sites.

Comment 5

[Stephanie Daugherty [:sdaugherty]]

Confirming this, it's valid as a feature request even though there seems to be a good chance that this will be a WONTFIX once a developer looks at it. 

This would be good as an extension though, as Tony suggested in comment #3.

Comment 6

[Justin Dolske [:Dolske]]

wontfix per comment 1 and comment 3.