Phishing attacks and solutions

Abstract

Phishing is a form of online identity theft employing both social engineering and technical subterfuge to steal user credentials such as usernames and passwords. Targeted data sources include especially Web pages, email spam, domain names. Mounting a phishing attacks may take several ways but the popular one takes the form of a phishing message arrives in the user mailbox pretending to be from a bank, directing the user to a web page and asking him to enter his credentials, but the web page is not one actually associated with the bank. In this paper, we focus on the Web site phishing, in which available solutions are based either on providing early warning of suspicious activity and rapid response or on the use of TLS (Transport Layer Security). We present the TLS-SRP (Secure Remote Password) and TLS-PSK (Pre Shared Key) protocols and we demonstrate how these two solutions can be useful to reduce the Web site phishing threats.