> Agreed but forcing phishers to generate key pairs, purchase > certificates, and/or buy-off CA vendor personnel creates additional > audit trails that could help in the tracking and prosecution of those > individuals. Combine this with certificate revocation and you have at > least a model that gives more verification, auditing, and remediation > than currently exists in the pursuit of these criminals. It's at least a > step in the right direction and shouldn't be avoided simply because it > won't immediately stop all phishing attacks or protect all users. > > Watermarks do not stop all counterfeiting. Holograms do not stop all > credit card fraud. It doesn't mean we shouldn't do what we can to help - > even if its only a partial solution. Phishing relies on the victim lacking the information or the intellectual capability to distinguish genuine email or web page from a fake one. That is why phishers attempt to use nearly-real URLs and shiny padlock icons so that the user feels a false sense of security and correctness when he sends in his social security number. If a phishing email is signed correctly, the email client will display a padlock icon on its own plus assurances that the email has been signed and valid and authenticated, etc. All this will further the false sense of security that phishing relies on, unless the email client is configured to explicitly display enough information on the signature and enough warnings for the average user to be able to make an informed decision. Philip
