604400 - Phising protection by password hash database

Status: UNCONFIRMED

(Toolkit :: Password Manager, enhancement)

Description

[Thorsten Sick]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.10) Gecko/20100915 Ubuntu/10.04 (lucid) Firefox/3.6.10
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.10) Gecko/20100915 Ubuntu/10.04 (lucid) Firefox/3.6.10

Warn the user whenever he enters a known password in an unknown domain.

Whenever the user enters a password in a page, check this against a database. If the password does not belong to this domain, warn the user ("This is NOT Amazon, but you just entered your Amazon password").

We would need a database storing URLs/Domains, password hashes and some salt.
Whenever a password field is about to be sent, check in this database for the hash. If a hash is found but does not match this Domain, warn the user.

The database is trained with each successful login.

This could only get tricky if the user uses one password on multiple domains and the browser is not trained yet (fresh installation). This way the user will get one warning to check the URL first for each new Domain where he is logging in.

Reproducible: Always

Comment 1

[Thorsten Sick]

I created an experimental plugin to find out if it works.

https://addons.mozilla.org/de/firefox/addon/nophish/

Discussion is here:
http://groups.google.com/group/mozilla.dev.security/browse_thread/thread/87f29946df726512

There are lots of large details to get right....

At the moment it is just very basic (and it already needs refactoring :-) )

Soon I want to enhance it.

The plugin will get the ability to connect to a Cloud Server. This will get us:
- Statistics (and we will know if it really works)
- The ability to whitelist FPs
- And connection to our AI for classification

Comment 2

[MartinZ]

I believe even just doing Bug 657871 would be an easy step to help with this concern