RSSIE, Mozilla Teams Claim Anti-Phishing Crown
By Scott M. Fulton, III | Published November 15, 2006, 7:15 PM
In an independent firm's test of the relative capability of the built-in anti-phishing filters for Mozilla Firefox 2.0 and Microsoft Internet Explorer 7, the Firefox filter was shown to be significantly more effective at detecting phishing sites. But Microsoft funded a separate study with far different results.
The sites used in the Mozilla test, conducted by Smartware Technologies, Inc., were selected from a list compiled by another independent firm: the trusted anti-phishing group PhishTank, which maintains a long list of more-than-suspicious sites, submitted by users in the field and tested for their lack of authenticity.
In a list of 1,040 known phishers supplied by the PhishTank group, 820 of the sites were blocked by Firefox 2.0 in its default state, while 848 sites were blocked with the browser's "Ask Google" assistance feature turned on. IE7, meanwhile, only managed to block 690 sites, in test results that Mozilla states were independently verified by security services firm iSEC Partners.
The Internet Explorer team, meanwhile, pointed to a separate study by 3Sharp, which rated IE7's built in anti-phishing feature far above that offered in Firefox. Microsoft asked 3Sharp to conduct the study, which involved 100 live phishing sites that were gathered using four independent sources of data.
According to 3Sharp, IE7 caught nearly 9 out of 10 phishing sites and generated no warnings on the 500 valid sites tested. It scored 172 points on 3Sharp's scale, with the Netcraft Toolbar following closely behind at 168 points. Firefox -- with Google's anti-phishing technology -- recorded a score of only 106, landing it in third place.
"We think that the results reported by 3Sharp validate the unique approach we’ve taken of combining a service-backed block list with client-side heuristics," said IE program manager Tony Chor. "That said, we understand that the threat posed by phishing is constantly evolving as are the tools designed to protect users, so this set of results represents only the relative performance during that period."
Missing from yesterday evening's statement from Mozilla is the fact that PhishTank already produces an add-in for Firefox 2.0 called SiteChecker, which uses the entire PhishTank list for its anti-phishing capabilities, and would thus presumably be 100% effective against this same list of sites, were it tested against Firefox 2.0 without SiteChecker, and IE7. (A similar add-in is not available for IE7.)
The SiteChecker add-in has been in development for some time, and was only released on November 3. The Smartware Technologies test, meanwhile, was conducted between October 19 to November 6, so SiteChecker's existence may not yet have been generally known.
Still, the PhishTank folks were hoping for a little more spotlight to come from yesterday's release of its test results. In a blog post on its company Web site, it thanks Washington Post IT security correspondent Brian Krebs for mentioning it on the Security Fix blog, but also commented, "Aww...only one sentence. Oh, well."
People always want to count quantity: security bulletins, vulnerabilities, number of viruses, number of phishing sites, etc. But it's QUALITY that counts, not quantity. Last week, there were almost 200,000 virus infections detected worldwide but less than 1,000 unique viruses were involved. Symantec detects over 70,000 viruses, but it would have been equally effective if it only detected 1,000. They just have to be the right 1,000.
How many of you have bothered to go through the actual URL lists used by each of these studies? The Smartware list is on the Mozilla site, and the 3Sharp list in the PDF report. Both are openly accessible (no registration or other hassle).
I looked at both lists, and both of them have lots of URLs that wouldn't have fooled ANYBODY. Then there are some URLs that I could imagine some AOL users getting tricked into clicking. Much fewer were the URLs that I could imagine being redirected to, while drunk or high, and taking more than a second to realize it. Those are the ones I would want an anti-phishing feature to catch, and there were more on the 3Sharp (IE) list than on the Smartware (Firefox) list.
Naturally, your opinion may vary, but if you reached it immediately after skimming this BetaNews article, and didn't bother to spend an extra 5 minutes looking at the actual studies, then you're just bashing (no matter which side you're on).
Score: 0
|"820 of the sites were blocked by Firefox 2.0 in its default state,"
"Missing from yesterday evening's statement from Mozilla is the fact that PhishTank already produces an add-in for Firefox 2.0 called SiteChecker"
so...is that to say it would be even better with the add-in, or that they were using the add-in to conduct the tests?
Score: 0
|They are saying which browser is better at anti-phishing. The report was conducted without the add-in. It would be better to use it though.
http://phishtanksitechecker.com
Score: 0
|I just installed FireFox and I have to say, I can't believe how cool this thing is.
Score: 0
|well of course ie7 is better(rolls eyes), especially when your paid to tell everyone it's better !
you get paid xxx millions of dollars to say the other product is better, I dare ya !
Truth is every time MS pays someone their product is better.
Let's do a fair NON paid comparison, huh ?
Score: 0
|How do you guarantee that a non-paid comparison will not be bias?
Score: 0
|I am just wondering, since the PhishTank report doesn't seem to show it. How many false positives did they get? How many of the phishing sites were active?
Score: 0
|no matter what firefox will always be the best & stable browser now & in the future!!!!!
Score: 0
|I hope that is sarcasm. If not, can I borrow your crystal ball?
Score: 0
|I don't use the "Phishing" crap in either browser. I'm smart enough to know which emails are fake and which web pages I should and shouldn't go to.
Man....people are such morons.
Score: 0
|Way to inspire consumer confidence Microskew...
Fund your own research study and skew the results in your favor just because your IE browser doesnt perform well...
Awww poor babies at MS, Mozilla just kicked your azz...
Score: 0
|I tend to agree with the "does it matter" query. This antiphishing exploit crap is only going to effect the dumba**es anyway, who would most likely be using IE, being that nobody with half a brain depends on IE to visit any sites outside of their own intranet....
Score: 0
|does it really matter? I mean those who just click on any link from an email deserve it. How hard is it type the site out and bookmark for future use. This way you know it is the official site.
Score: 0
|I believe Firefox will probably be quite good in terms phishing plus it is constantly worked on. In regards to Vista / IE 7, lets just wait until windows is released to the general public and then we can talk.
http://www.metallica-central.com
Score: 0
|Those s***s at Microsoft.
You can't take a test pool of 100 sites and claim victory of 9 of 10. That's just asinine.
Score: 0
|people who actually reads these reports aren't the ones getting phished anyway.
Score: 0
|Absolutely the OPPOSITE.
Who still may believe in IE7 (MS behind it), are the ones phished.
Score: 0
|Your logic (if there is any in your comment) makes no sense.
Score: 0
|Come on.
It's obvious which one is more apparently objective. What MS is doing is like a drug company sponsoring a study to show its drug is better.
Score: 0
|Yeah, Smartware Technologies, Inc. has no motivation to tie themselves to FF...
You don't know the objectivity of either one.
Score: 0
|it's always the same. MS says they are the best. Of course, no one would criticize himself as to ruin his reputation, but MS is too much.
Score: 0
|Independent study says one thing (FireFox is better). Micropsud doesn't like the result so they pay to get one that suits them.........Typical Microspud BS.
Score: 0
|Interesting!
Who can give a standard of this kind of test?
Score: 0
|You show me a study showing one thing, ill show you a study showing something else. Studys are subjective, and the supposed 'independent study' putting firefox in front, is no more independent than the one put forward by Microsoft. The fact of the matter is, both products offer effective anti-phishing functionality and both are virtually equally effective in my opinion. And yes, as the person stated below, people that are targeted by phishing aren't the type of people that read Betanews articles. And enough of the Microsoft bashing. You're entitled to an opinion, but dont slander Microsoft because you don't like their product. If you dont like it, don;t use it. Even boast the product you do use, but theres no need for the anti-Microsoft retoric that constantly dribbles from the mouthes of you so-called 'Open-Source junkies'. Enough is enough!
FYI: I run Internet Explorer 7, recently uninstalling FF2 purely because I like the interface and cannot live without the OS interoperability that IE7 offers. Good job Microsoft, you've delivered an outstanding browser.
Score: 0
|Have to say,
'well said'.
And I actually prefer FireFox, but have never understood the need to bash MS in every message. I don't drive a Ford, but I don't feel the need to slander the company every time I open my mouth.
I'm wondering if the more vocal sections of the OS community are just a little nervous about the Vista release.
Score: 0
|