Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and protect from SSL-strip:

  • Check that it is the address of your bank in the address bar of your browser before you log on to your internet bank.
  • The web address on the log on page should start with https:// and a padlock symbol should be visible in the browser.

This is a fairly important topic, since some Swedish banks serve their main page (where the link to the internet bank is) over HTTP, and none of them have implemented HSTS. However, I see a number of problems with the advice given:

  1. How do I check that it is the adress of my bank? An ordinary user would probably go scanning the URL for the name of the bank, and be satisfied when they find it. So armed only with this advice you would easily fall for mybank.com.evil.com/mybank.com. (Unfortunately the URL for logon pages are often not very clean, so customers would expect a messy URL.)
  2. "So I remember there was something with an h and a couple of p or t or something I should look for. http://? Yeah, that was probably it. Must be safe."
  3. Look for the padlock in the browser? Seriously? You can just include it in the page, don't even need to use the old favicon trick to fool someone reading this advice.

Naturally I started to think about what some actual good advice would be to give on this subject, but I found it surprisingly hard. The advice should be (A) short, (B) easy to remember and understand even for a user with little technical knowledge, and (C) apply to all fairly modern browsers. Imagine you have 30 seconds to explain this to a not very-tech savvy relative.

Any suggestions?

share|improve this question
4  
I'd recommend using a bookmark. That way you can only be tricked on the first access. – CodesInChaos Feb 1 at 16:06
7  
Tell them that the "s" in "https" stands for "secure." That might help with issue number 2. – Brian McCutchon Feb 1 at 17:05
    
My advice would be take the advice of the two previous comments, and also tell the users that the server they are talking with is the one named between the two / characters. (Some browsers will highlight this part of the URL to make it easier to spot.) – kasperd Feb 1 at 18:43
up vote 28 down vote accepted

I was going to suggest that ensuring that the login screen for the online banking system showed the name of the bank in green, in the address bar might work. But then I started wondering if any of the local banks I know about did that properly.

URL bars of UK banks

It's less encouraging than I'd hoped. For these nine fairly large banks, 6 provide the name of the bank in the EV cert bar. 2 provide the name of the parent group (which might not always be obvious), and one doesn't even have an EV certificate.

The EV certificate is designed to make this easy, if it's used properly - you can't fake it easily, and it's outside the page area, so can't be inserted by a malicious actor. However, it seems that banks aren't doing so well at using it..

share|improve this answer
4  
Very good point. Though, what if someone registered "HSBC Holbings plc" or "HSBC Holdings ltd"? They'd get me fooled for sure :-) I agree with you that those new security indicators make it easier to read/process the URL but they inherently have the same issue as URLs, just on a lesser scale. – Steve DL Feb 1 at 10:48
4  
I guess checking that the certificate is from the right jurisdiction is also important (the [GB] part). I have a feeling that phishers will prefer to get their certificates from somewhere where law enforcement is a bit more lax. – Anders Feb 1 at 11:56
2  
@Anders That might be why Santander doesn't have one, actually - Spanish banking group, running British banks. Not sure which country code should be there. – Matthew Feb 1 at 11:57
7  
It's worth noting that asking for an SSL cert with the words "Bank", "Banking", "Holdings" etc, will trigger a secondary verification process by the SSL vendor, which will prevent any certificate forgery like that. Even on more lax sites like GoDaddy. – Ohnana Feb 1 at 16:29
4  
@SteveDL ... Not sure it entirely works in practice, but in order to obtain an EV cert, you still need to have a corporation properly registered in that name, which means you had to provide a real person's identity to the government where that corporation was registered... so it should be easier to prosecute you for fraud or sue you for trademark infringement, even before you apply for a certificate or domain. – david Feb 1 at 17:49

Why security indicators fail vs. phishing

There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers.

You are correct that checking for URL correctness is error-prone, and HTTPS passive security indicators are a big joke. They go unnoticed, they have for years been meaningless (what does it mean if the keypad is blue or green or grey!?), and were they to be more prominent / active, people would get habituated to see them and attacks could simply buy a certificate for a rogue URL so that the name checks out.

The solution to this issue must be architectural, rather than rely on wasting the time of humans and on said humans to not make mistakes. Why is it that Web browsers don't have a centralised, trusted repository from which to verify the URLs of banks and reputable payment/transfer websites, so that unique security indicators can be used for such sites?

Solution: make users rely on a secure interaction rather than make them deal with the limitations of indicators

I would tell people to go onto the website once, make sure the URL is correct once (you can help them), and save it in their favourites. And use exclusively the favourites button so they know they are on the right website. I would tell them (without details) that you never know where you'll land when clicking a link or searching for a website but the favourites button always takes you to the right place. How? Doesn't matter.

At this stage, users are guaranteed to land on the correct URL. If an active MITM attack is occurring, they will get the scary certificate warning, which they normally don't have for their banking website. Warning habituation is a very real thing, and figures are missing to determine whether users would pay attention to it in the context of a previously trusted banking website. Improving on this warning (e.g. making it scarier for bank sites) would also require knowledge of what is and isn't a bank's website.

share|improve this answer
7  
Why is it that Web browsers don't have a centralised, trusted repository from which to verify the URLs of banks and reputable payment/transfer websites, so that unique security indicators can be used for such sites? I thought that system is called the EV certificate? – Lie Ryan Feb 1 at 12:43
1  
RE: your specific point let's see in 5 years' time what Indian or Chinese issued EVs look like. But this is not quite what I wanted to discuss anyway. You might be able to perfectly identify a business, you still need to transform this feature into an interaction and interface design that stands out in helping users know effortlessly they're on their bank's site when they mean to. And you have to cover (a) indicating that the current site is the bank site and (b) ensuring that users, when they mean to go to their bank site, understand the indicator and notice its absence. – Steve DL Feb 1 at 13:39
2  
@SteveDL Don't you think "Always check that it says 'My Bank [GB]' in a green box in the address bar." would be good advice that would live up to the requirements in the question? – Anders Feb 1 at 16:27
1  
@Anders I've got mixed feelings on that. It's been demonstrated passive SSL padlocks are not very useful because people forget to check for them, and that they're economically detrimental. There's also the issue of simply satisficing presence rather than checking content, making attacks with fake EV certs not unlikely. Without an updated study on EV certs in banking contexts I suspect but cannot assert that they're mildly beneficial to check for. – Steve DL Feb 1 at 17:05
1  
@R.Daughtry Correct me if I'm wrong, but if the hosts file has been compromised then my computer has been compromised, and then it's game over anyway? – Anders Feb 2 at 8:14

"I am asking how to explain to an ordinary user how to check that the browser is using HTTPS and that you are on the right site..."

I agree with what others have said here about looking for the lock as well as the "s" in https and verifying that the url after the // is correct. That is what I remind my clients to do. All financial institutions will have these things as a minimum

Other approaches like the "green name" in EV certs are helpful but not all banks use them because they are much more expensive and take more paperwork to implement (to prove who you are) than a standard SSL cert.

Two things I'd add to the discussion are to maybe focus on how people get to the banking site.

If they're getting there via a bookmark (ok as long as you always use the same computer and browser), or via the bank's mobile app, or by typing in the (hopefully short and spelled correctly) url of their bank each time, then they're much less likely to encounter phishing or MITM attacks.

However if they're responding to a link in an email claiming to be from the bank (always dubious), or off a search engine's results, then they should be extra cautious or avoid these avenues altogether.

The other thing I do with my clients is to warn them of the consequences if they get careless... like discovering transactions they didn't make and/or money gone from their account, transferred to countries where recovery might well be impossible (such as Russia or China). Basically, a little fear/paranoia can go a long way toward keeping folks vigilant and their accounts safe. Hope this helps!

share|improve this answer
    
Thanks for the answer! I think focusing on how you reach the site is a good idea. To you advice of typing the address yourself, I would like to add that you should type the address including the https://. – Anders Feb 1 at 20:24
    
About the URL. I think it needs to be from the // to the /. And here it starts being a bit complicated if the URL looks messy... – Anders Feb 1 at 20:27

Essentially your question is one of authentication. In this case, it's users authenticating the bank website is actually the bank.

I think you're right, and the user is going to have difficulty in authenticating the bank through the URL (many banks have multiple URLs for instance). You're also correct that users aren't terribly sophisticated about URLs, and don't (and can't be trained) to understand it properly.

One approach I've seen at some banks is the bank always displaying a shared secret before the user authenticates. It works something like this:

The user does a pre-authentication by entering in a username, and an answer to a security question.

The website displays an image, word, or both that the user has selected. This provides assurance that the bank is actually the bank, since only the bank knows the image or phrase that the user has chosen.

The user then enters the password.

share|improve this answer
    
Thanks for the answer! That is an interesting system, but it is to little help for the person I am trying to advice if the bank hasn't implemented a system like that. Also, isn't it sensitive to MITM-attacks? The middle man takes the username and send to the bank, getting the image. It then presents the image to the user. So I still need to check that TLS is used to safeguard against MITM. – Anders Feb 1 at 16:22
1  
Oh it still relies on a TLS connection. That's still true of course. But it still forces the attacker to perform an active attack, contacting the bank to retrieve the image. You might stand a chance of actually detecting a mass attack like this through analyzing geo-locations of where users typically login from. Realistically, banks should be using 2-factor authentication. Only one of my banks does this. – Steve Sether Feb 1 at 16:31
    
Would you say using an image like that would be enough to not also have to check that you are on the right site and using TLS? – Anders Feb 1 at 16:58
    
@Anders Probably not. But that's not the real question. You're thinking for an individual user. I'm thinking of preventing massive spoofing attacks. Remember, security is also often about just not being the LEAST secure. Attackers necessarily pick the easiest target. It's like the old story about not having to run faster than the lion. You just have to run faster than the slowest person in your group :). – Steve Sether Feb 1 at 17:02
    
@SteveSether I know the system you're referring to and even though its name has eluded me, I am ~80-90% confident there is a paper out there explaining how it has successfully been defeated. It turns out that when you tell people on the Internet that a server is under maintenance and images cannot be loaded, a fair share of them will believe you :-) – Steve DL Feb 2 at 0:55

I like to rely on the auto-fill feature of my password manager for this check.

The rationale is that I will not be clever enough to match the site URL in the browser to the expected one, while a password manager will.

So when I see that it has filled in the entry for the site - the site is genuine, otherwise I should start to worry.

The password manager must of course be "good", but that is another problem.

share|improve this answer
    
That it is indeed an elegant solution to see that you are on the right page. However I guess it does not help you check you are using HTTPS. Thanks for the answer! – Anders Feb 5 at 16:39
1  
@Anders: checking for HTTPS does not really matter in that case. You will be matched with the correct URL, which hopefully is HTTPS. You do not need to check anything beyond the fact whether your credentials are filled in or not. If they are then you are on the right page (HTTPS or not, though it will be HTTPS). If you have a site which has both HTTP (on the front page for instance) and HTTPS (on thelogin page) then your match will be against https://the.bank.address/login and http://the.bank.address/login or anything else will fail to match and credentials will not be filled in. – WoJ Feb 5 at 16:45
    
Oh, right! Smart! – Anders Feb 5 at 17:04

Steve DM's answer (checking and bookmarking the page) is better from an absolute security standpoint, but another viable (and possibly more user friendly) option is to tell them to Google the bank every time instead of clicking on a link.

This way, you rely on Google taking you to the right place rather than some shady link and your observational skills.

It's easy, and something your friend already does on a regular basis.

NOTE: This is still susceptible to MITM attacks, but it will prevent basic phishing attacks. I'd just tell a non-tech savvy person to always Google their bank (and other sensitive sites) and to not log on to sensitive websites at public places.

share|improve this answer
    
Then they would have to check that their connection to Google is safe. – Benoit Esnard Feb 1 at 16:59
    
But if google take me to http://mybank.com where there is a link to https://secure.mybank.com I would still be vulnerable to MITM with SSL-strip. – Anders Feb 1 at 17:00
3  
I'd never want to trust Google search results to bring up the right site. It's easy enough to manipulate Google searches that it's become a sport. screamingfrog.co.uk/google-bombs Just ask Rick Santorum what he thinks about the accuracy of typing in something into Google and getting what you're searching for. Even 13 years later this jackass is better known for the disgusting definition of his name rather than him. – Steve Sether Feb 1 at 17:19

Yes. Use an app that is definitely connecting to the site.

Or. Check the https. Verify the url. Make sure the url is short enough to visually see tampering. Also, maybe some examples of homographic attacks.

share|improve this answer
10  
...unless the app has been tampered with. – Trang Oul Feb 1 at 13:39
    
And given apps can hide what kind on connection they are using, it may not even be secure in the first place. – Petah Feb 2 at 1:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.