Sam / Yossi – you guys are better looking as nerds. time for a fashion change?

You need your own cartoonist to draw on your new blackwall.

Very interesting read. We at Blue Strata Trading have been on Pinpoint Securemail for some time now and I have to admit that the latest advancements made by SYNAQ, in stamping out phishing attacks have been impressive. So much so that I cannot recall the last time I received one of these mails.

Well done SYNAQ!

But in enforcing a highly effective and accurate anti-phishing product for the past 6 months, SYNAQ has come to learn that the financial institutions themselves bear a large portion of the blame for the success of phishing attacks. The banks for instance, would have you believe that the end user is responsible for discerning the validity of genuine bank from fraudulent mail. However, in the past 6 months we have seen many different angles of attack from fraudsters, some of which appear to be so authentic that your average end user would have great difficulty making the right decision.

I say this is the bank’s responsibility because the bank itself is responsible for enforcing a reputation of trust and maintaining that reputation with it’s clientele. This means that they are responsible for ensuring the reliability of all transaction servers bearing their reputation – from the reliability and security of their internet banking, to the reputation of their email. As such, in practice, no mail should legitimately represent the bank if it does not come from a fully endorsed server which is directly under the control of the bank itself. For example, would you bank with them if they were running your critical and security sensitive transactions on a public co-located server? Then why is this acceptable for their email transactions?

For phishing to be effectively squashed, one should not have to look any further that the originating ip address of the smtp server itself. I should be able to tell with 100% certainty that the server submitting bank email to me is a certified and well controlled banking ip. The waters only get muddied when they allow business partners, marketing companies and surveyors to email in their name from any smtp service they want to. Banks and financial institutions should, in all of areas of communication, be the very embodiment of security, confidentiality and trust. Instead they permit uncertainty in an unregulated and unverified smtp free-for-all where it is difficult to tell a spammer source from the bank servers themselves. It is in this environment where phishing thrives, where you cannot verify the email against a trusted source.

Regards