Quote:
Originally Posted by rryles
They say they only intercept port 80 so no DNS. Intercepting DNS queries would solve some of the issues but far from all. To come up with a half decent system they would have to intercept ALL traffic. Consider this:
https://258.23.239.2:22/
(IP address intentionally broken so it doesn't go anywhere)
The bottom line is this is a bad way to implement phishing protection. |
Your example proves a very valid point. Phorm would have to look at all ports and look at the protocol being used (http) and then decide if its a phishing attack. Othewise, as your example shows, it would be so easy to circumvent the phorm anti-phishing "service", even for http attacks, let alone https.