What Phishers Can Teach You - How Users Sniff Out Bogus Sites
(Page 2 of 4 )
The study’s authors found that the participants used five different strategies to determine the legitimacy of the web sites with which they interacted. There was no significant correlation as to age, gender, educational level, etc. and which strategy a participant used. There was, however, a definite correlation as to which strategy a participant used and his or her ability to correctly identify legitimate and bogus web sites.
The first strategy, used by about a quarter of the participants, involved looking for security indicators in website content only. This included examining “logos, layout and graphic design, presence of functioning links and images, type of information presented, language, and accuracy of information.” These participants did not look in the address bar or any other part of the browser for security information. Those using this strategy received the lowest scores for being able to correctly distinguish legitimate and bogus web sites.
The second strategy involved checking not only the web site’s content, but the browser’s address bar. While these participants were not sensitive to factors such as “HTTPS” in the address bar, they at least noticed when it changed from site to site. Those using this strategy scored somewhat better than participants judging based on web site content alone.
Two of the study participants used the third strategy, which involved checking web site content and address bar, and noticing the presence of “HTTPS” in the address bar. They didn’t look for the padlock in the address bar, however. This approach was somewhat unreliable, as one of the participants using it incorrectly believed that site icons (favicons) in the address bar were a good indicator of site legitimacy because they couldn’t be copied (which of course is false).
The fourth strategy used by study participants involved being aware of everything in the third strategy, plus the padlock icon. Five participants used this approach. As you would expect, it was more reliable than the third strategy.
Finally, two participants used a strategy that looked for everything you’d find in the fourth strategy, and also checked for SSL certificates. This was the strongest approach as far as being able to distinguish legitimate and bogus sites.
Next: How Well Did They Do? >>
More Website Promotion Articles
More By Terri Wells
/ 12 
