Phish Phight
PayPal, often the target of phishing scams, has published a white paper outlining methods in which the popular payment site intends to combat such threats in the future.
Among the recommendations is the use of Extended Validation SSL certificates. The move is a welcome one but the relative lack of support for EV SSL certificates in browsers looks set to pose problems for users, in particular Macintosh users.
PayPal has already stated that older browsers such as Internet Explorer 3 and 4 will be blocked from using their service, however, by making EV SSL support mandatory, users of Safari, the browser that ships with all Apple computers and iPhones, will be blocked too.
The paper, co-authored by PayPal heavyweights Michael Barrett, chief information security officer and Dan Levy, senior director of risk management, Europe states that they are 'in the process of re-implementing controls which will first warn our customers when logging in to PayPal from those browsers that we consider unsafe.'
However they continue, 'later, we plan on blocking customers from accessing the site from the most unsafe – usually the oldest – browsers.'
The race is on
For users of Safari it's a race between Apple bringing in modifications to the popular Mac browser or them choosing an alternative. The problem is exacerbated by the fact that the popular multi-platform browser, Firefox doesn't support EV SSL without first installing an extension.
Firefox 3.0, slated for launch early in the summer will support EV SSL certificates. The surprising fact is that Internet Explorer 7 is currently only browser out of the trinity which comprises of over 95% of all Web surfing to support EV SSL certificates 'out of the box'.
The authors go on to detail other measures that have been undertaken by PayPal such as the use of warning pages, blacklists and authentication.
Evidence provided suggest that these changes have indeed had a positive impact on reducing the 'phishing volume' over time adding that their own results have 'surprised' them.
Whether other retailers will follow suit and require the support of EV SSL certificates is unclear at this point, however judging by the success enjoyed by PayPal through incorporating the technologies outlined by Barrett and Levy, it may not be long until we see increased security checks when shopping online.
