search

spotphish / spotphish

Chrome extension for zero-hour phishing protection
Other
17 stars 6 forks source link

Security image not displayed #38

Open kousik97 opened 6 years ago

kousik97 commented 6 years ago

The security image which was seen while accessing gmail has disappeared all of a sudden. One good thing about this is that, now I have got used to the security image that I am alerted by the lack of it(hence, reached the goal of spotphish). Possible reason behind this anomaly might be that the link to login page has changed. But anyway the logo is the same, so is spotphish not supposed to alert me since I am accessing a webpage which has the same logo as gmail but is not genuine? Can you please look into this.

ganeshv commented 6 years ago

Glad you noticed the absence of the security image - mission accomplished :)

The URL has changed, we need to update our list. You could do so as well, by hitting the icon and doing "Protect Page" on the new login page.

The behaviour you describe is expected. We automatically mark the domain of every protected page as a "safe domain", which means pages on those domains and subdomains are not subjected to (expensive) image search as they are assumed to be highly unlikely to host phishing pages. This is done for two reasons.

Firstly, we optimize on browsing performance and overhead for the 90% case.

But more importantly, we want to avoid the precise scenario you encountered - flagging a page on a legit site which contains its own logo as a phishing attempt. There are guaranteed to be several such pages for each site. Saying "this page looks like Google - but it's not" when it is hosted by Google would be deeply confusing and annoying to the average user. The villagers might forgive the boy crying wolf on spotting a zebra, but they will not forgive him crying wolf over a sheepdog who's lost his collar :)

kousik97 commented 6 years ago

I thought that spotphish is marking the webpage to be safe rather than the domain. This explains the anomaly. But if users are to update the protected pages list every time the domain changes its login page, will they not loose interest in the product? One possible solution to this problem and the one regarding facebook is to make spotphish classify whether a webpage is a login-page or not. So that whenever login page from a safe domain is accessed, the security image can be displayed without the need for the user to explicitly protect that updated page.

anil5356 commented 6 years ago

Classifying a page as a page that asks for user creds sounds like a good idea. This will also help us cover pages other than the ones flagged by user as protected.