A study of anti-phishing toolbars by researchers at Carnegie Mellon University failed to find a single capable product.
The Evaluation of Anti-Phishing Toolbars (PDF download) compared 10 anti-phishing toolbars, including Google Toolbar, McAfee Site Advisor and Netcraft, as well as the anti-phishing filter built into Internet Explorer 7.
McAfee SiteAdvisor does not offer anti-phishing functionality, but the company launched SiteAdvisor Plus earlier this month that offers real-time anti-phishing protection.
The Carnegie Mellon researchers prepared a series of experiments that included identifying recently discovered phishing sites, identifying phishing sites over a period of 24 hours, and differentiating between phishing sites and legitimate sites.
Even the top performers failed to catch nine to 15 per cent of the phishing sites visited. SpoofGuard, which correctly identified 91 per cent of the phishing sites, also labeled 38 per cent of the legitimate sites as phishing operations.
"Overall we found that the anti-phishing toolbars examined in this study left a lot to be desired," wrote the researchers. "Many of the toolbars we tested were vulnerable to some simple exploits as well."
Aside from reliability, the study found the user interface on several products ineffective. Many of the toolbars used warning dialogues to indicate when a phishing site was found.
Because many users have been desensitised to pop-up ads and dialogue windows in web browsers, they may simply dismiss the warnings and enter personal information on the phishing site.
"When using an anti-phishing toolbar, poor usability could mean the difference between correctly steering someone away from a phishing site and having them ignore the warnings only to become a victim of identity theft," wrote the researchers.
- Phinding Phish: An Evaluation of Anti-Phishing Toolbars
- Mozilla claims anti-phishing crown
- Cyber-criminals gear up for a merry Christmas
- Web browsers to adopt enhanced SSL
- Phishing scams push up web banking fraud losses
Wikileaks Vault 7 suspect Joshua Schulte fingered by FBI after re-using smartphone passwords on his PCs
Joshua Schulte indicted on 13 counts relating to Vault 7 leaks and trading in images of child abuse
Alexa for Hospitality will link with existing systems so guests can order room service and control the air con
Massive volcanic eruptions could have warmed Mars' surface sufficiently for oceans to form
Examination of fruit flies' brains generated more than one billion data points for scientists to analyse