« Welcome | Main | Update on USA vs Smathers et al. »

September 28, 2004

Phish poison

In the past week or two, I've received dozens of "phishing" emails (despite my ISP's use of the Spamhaus Block List to filter out spam). Most of the emails claim to be from Citibank.com, WellsFargo.com, or PayPal.com. I decided to check whether any banks or online financial institutions were using Sender Policy Framework (SPF), the new technology being proposed to solve email spoofing. I was surprised to learn that not a single major bank has published an SPF record. But, as I wrote in a new article for the O'Reilly Network, SPF Not Poisonous to Phish, banks may have a good reason for not climbing on the SPF bandwagon. In short, SPF doesn't really prevent phishing attacks.

Posted by brian at September 28, 2004 12:57 PM