Reader Comments (rss)

(Flattened / Threaded)

• 

  Team Tutorials, Jul 23rd, 2007 @ 9:06am

  
  

  Phishing scams work because people are stupid. No study needed.

  [ reply to this | link to this | view in chronology ]

• 

  Ant, Jul 23rd, 2007 @ 4:25pm

  
  

  Re:

  Yep, all humans are stupid. :(

  [ reply to this | link to this | view in chronology ]

• 

  Aaron, Jul 23rd, 2007 @ 9:31am

  
  

  But honestly officer, I was simply researching the effects of heroine for my study!

  [ reply to this | link to this | view in chronology ]

• 

  Anonymous Coward, Jul 23rd, 2007 @ 5:26pm

  
  

  Re:

  I know you're just trying to be funny but there are massive research into drugs, both legal and illegal.

  [ reply to this | link to this | view in chronology ]

• 

  Steven, Jul 23rd, 2007 @ 11:12am

  
  

  In order to stop phishing...

  don't you have to know how it works?
  
  I understand the privacy implications here, but how is a research supposed to come up with ways to reduce phishing without knowing what how/why it works (including stupid people)?
  
  It seems to me that knowing what was most effective would at least be good fodder for an education campaign.
  
  This is like saying a security firm shouldn't be finding exploits in computer systems because that is just helping hackers.

  [ reply to this | link to this | view in chronology ]

• 

  Just Me, Jul 23rd, 2007 @ 11:30am

  
  

  Phishing

  1. You need to understand phishing to stop it. However, be carefully waht information you collect, as I'm sure the college will 'misplace' it publicly.
  2. Stupid People will never go away. Can we say why UAC in Vista can be good. Or how can people really believe that they had a rich relative who died in Nigeria?

  [ reply to this | link to this | view in chronology ]

• 

  Anonymous Coward, Jul 23rd, 2007 @ 12:27pm

  
  

  Well I can understand...

  
  but oddly, the article seems to highlight what works for phishing scams, rather than what works to stop phishing scams. So, right now, the research seems to be telling scammers how to be more effective scammers, rather than coming up with ways to stop phishing.
  
  
  They could be using the idea of exsposing the way the phishers operate. That way if the "secret" to phishing for info is no longer secret and everyone knows about it then people will hopefully wise up a bit. Kinda like someone telling how the magician made the elephant disappear.

  [ reply to this | link to this | view in chronology ]

• 

  anonymous coward, Jul 23rd, 2007 @ 1:21pm

  
  

  if taking money from morons is a crime, why is Steve Jobs still walking our streets as a free man?
  
  phishing isn't a victimless crime, its just that the victims are so f'ing stupid, it is really a challenge to work up any sympathy.
  
  i have more sympathy for drunk guys that get rolled by hookers...

  [ reply to this | link to this | view in chronology ]

• 

  Markus Jakobsson, Jul 23rd, 2007 @ 4:35pm

  
  

  why to perform phishing experiments

  At first, many people may not see the benefits of phishing experiments, and may see it as a way to plainly confirm what is already known ("people fall for phishing attacks".) That is not what is done in phishing experiments, though.
  
  First of all, in a well designed experiment, no credential is even harvested by the researcher. Instead, he or she instead verifies that that right credentials were input -- using the legitimate verification service. An example of how this is done, in the context of phishing eBay users, is available in
  
  http://www.informatics.indiana.edu/markus/papers/ethical_phishing-jakobsson_ratkiewicz_06.pdf
  
  This, and other experiments, are described from the ethical point of view in
  
  http://www.indiana.edu/~phishing/papers/finn-conducting.pdf
  
  Why are experiments useful, then? I think a good way to explain the needs for experiments is:
  
  1. To improve phishing countermeasures, knowing what works and what does not.
  2. To predict trends, knowing what the yet not exploited human vulnerabilities are.
  3. To improve security education. An example effort is www.securitycartoon.com -- this is directly influenced by phishing experiments.
  
  Cheers,
  Markus

  [ reply to this | link to this | view in chronology ]

• 

  rebecca, Jul 23rd, 2007 @ 6:08pm

  
  

  research on phishing

  it works because we sit around researching it rather than doing anything to stop it. We allow it and they know it.

  [ reply to this | link to this | view in chronology ]

Add Your Comment