<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Non-cooperation in the fight against phishing</title>
	<atom:link href="http://www.lightbluetouchpaper.org/2008/10/16/non-cooperation-in-the-fight-against-phishing/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.lightbluetouchpaper.org/2008/10/16/non-cooperation-in-the-fight-against-phishing/</link>
	<description>Security Research, Computer Laboratory, University of Cambridge</description>
	<lastBuildDate>Fri, 10 Feb 2012 17:31:40 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Clive Robinson</title>
		<link>http://www.lightbluetouchpaper.org/2008/10/16/non-cooperation-in-the-fight-against-phishing/comment-page-1/#comment-29975</link>
		<dc:creator>Clive Robinson</dc:creator>
		<pubDate>Sat, 25 Oct 2008 07:25:56 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=440#comment-29975</guid>
		<description>@ Eric Olson,

&quot;I believe their prescription is exactly the wrong one. Rather than improve protection for banks and consumers, this proposal would in fact have the opposite effect.&quot;

As a first order effect I think you are probably correct on this.

Also I very much agree with you on the current likley outcome,

&quot;Those with the best technology and people will simply devote their staff, budget and expertise to other products where they are not being told to give away the value they have worked so hard to create.&quot;

However I would look on this as an issue that should be dealt with differently.

First and formost the banks should not be alowed to externalise the risk of the services they provide onto their service users (customers and merchants).

Secondly the user technology real realy must be sorted out both the browser and the service provision on the banks servers (Googles Chrome may be a step in this direction).

Thirdly there is already examples from other financial services of &quot;pooling of resources&quot;. There are various organisations like credit refrence checking services medical and other insurance claims databases that are effectivly industry funded as comercial propersitions.

It would be better for both the banks and their customers if there would effectivly be one or two organistons actually doing the take down process. The economy of scale and the efficiency of dedulication of effort would provide sufficient margin to reduce costs to the banks and be profitable for  independent organisations.</description>
		<content:encoded><![CDATA[<p>@ Eric Olson,</p>
<p>&#8220;I believe their prescription is exactly the wrong one. Rather than improve protection for banks and consumers, this proposal would in fact have the opposite effect.&#8221;</p>
<p>As a first order effect I think you are probably correct on this.</p>
<p>Also I very much agree with you on the current likley outcome,</p>
<p>&#8220;Those with the best technology and people will simply devote their staff, budget and expertise to other products where they are not being told to give away the value they have worked so hard to create.&#8221;</p>
<p>However I would look on this as an issue that should be dealt with differently.</p>
<p>First and formost the banks should not be alowed to externalise the risk of the services they provide onto their service users (customers and merchants).</p>
<p>Secondly the user technology real realy must be sorted out both the browser and the service provision on the banks servers (Googles Chrome may be a step in this direction).</p>
<p>Thirdly there is already examples from other financial services of &#8220;pooling of resources&#8221;. There are various organisations like credit refrence checking services medical and other insurance claims databases that are effectivly industry funded as comercial propersitions.</p>
<p>It would be better for both the banks and their customers if there would effectivly be one or two organistons actually doing the take down process. The economy of scale and the efficiency of dedulication of effort would provide sufficient margin to reduce costs to the banks and be profitable for  independent organisations.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Eric Olson</title>
		<link>http://www.lightbluetouchpaper.org/2008/10/16/non-cooperation-in-the-fight-against-phishing/comment-page-1/#comment-29948</link>
		<dc:creator>Eric Olson</dc:creator>
		<pubDate>Wed, 22 Oct 2008 21:05:25 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=440#comment-29948</guid>
		<description>I completely agree that time is the critical matter in taking down phishing sites.

Unfortunately, I respectfully have to differ with your suggested method for improving those times. I believe their prescription is exactly the wrong one. Rather than improve protection for banks and consumers, this proposal would in fact have the opposite effect. Speed in detection and takedown both take technology, staff, and expertise, in other words, investment and lots of it. Mandating that the strongest players undermine their own return on that investment by giving away the data (derived at huge expense) to their feebler competitors will only incent the competent players to exit the market.

Those with the best technology and people will simply devote their staff, budget and expertise to other products where they are not being told to give away the value they have worked so hard to create.

he banks that rely on these providers will thus be left with only the least efficient, least competent vendors to choose from, and the performance and protection offered will suffer, not improve. For a more complete explanation of this differing opinion, including a discussion of why the A/V industry is not in fact a proper analog for this suggestion, please see

&lt;a href=&quot;http://www.cyveillanceblog.com&quot; rel=&quot;nofollow&quot;&gt;A Contrary Perspective --­ Forced Data Sharing Will Decrease Performance and Reduce Protection&lt;/a&gt;

Respectfully,
Eric Olson - Vice President, Cyveillance, Inc.</description>
		<content:encoded><![CDATA[<p>I completely agree that time is the critical matter in taking down phishing sites.</p>
<p>Unfortunately, I respectfully have to differ with your suggested method for improving those times. I believe their prescription is exactly the wrong one. Rather than improve protection for banks and consumers, this proposal would in fact have the opposite effect. Speed in detection and takedown both take technology, staff, and expertise, in other words, investment and lots of it. Mandating that the strongest players undermine their own return on that investment by giving away the data (derived at huge expense) to their feebler competitors will only incent the competent players to exit the market.</p>
<p>Those with the best technology and people will simply devote their staff, budget and expertise to other products where they are not being told to give away the value they have worked so hard to create.</p>
<p>he banks that rely on these providers will thus be left with only the least efficient, least competent vendors to choose from, and the performance and protection offered will suffer, not improve. For a more complete explanation of this differing opinion, including a discussion of why the A/V industry is not in fact a proper analog for this suggestion, please see</p>
<p><a href="http://www.cyveillanceblog.com" rel="nofollow">A Contrary Perspective &#8211;­ Forced Data Sharing Will Decrease Performance and Reduce Protection</a></p>
<p>Respectfully,<br />
Eric Olson &#8211; Vice President, Cyveillance, Inc.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Tyler Moore</title>
		<link>http://www.lightbluetouchpaper.org/2008/10/16/non-cooperation-in-the-fight-against-phishing/comment-page-1/#comment-29927</link>
		<dc:creator>Tyler Moore</dc:creator>
		<pubDate>Mon, 20 Oct 2008 15:14:09 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=440#comment-29927</guid>
		<description>@Chris: Thanks for your comment.  The purpose of this paper was to empirically measure the effect of not sharing phishing URLs.  Modeling the trade-offs game-theoretically, as you suggest, is a natural thing to do.  We chose to leave this as future work out of space considerations.</description>
		<content:encoded><![CDATA[<p>@Chris: Thanks for your comment.  The purpose of this paper was to empirically measure the effect of not sharing phishing URLs.  Modeling the trade-offs game-theoretically, as you suggest, is a natural thing to do.  We chose to leave this as future work out of space considerations.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Chris</title>
		<link>http://www.lightbluetouchpaper.org/2008/10/16/non-cooperation-in-the-fight-against-phishing/comment-page-1/#comment-29905</link>
		<dc:creator>Chris</dc:creator>
		<pubDate>Fri, 17 Oct 2008 17:54:08 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=440#comment-29905</guid>
		<description>Maybe it&#039;s me, but when I read the paper, I immediately thought of it as describing an Assurance Game.  Is there a reason you didn&#039;t more formally articulate the choices facing the take-down firms game-theoretically?  It seems as though you -- in stark contrast to others doing related work -- have actual data to use in constructing payoff matrices.

I don&#039;t mean this to sound like a &quot;Why didn&#039;t you write the paper I would have written?&quot; comment.  My very sincere apologies if it does.</description>
		<content:encoded><![CDATA[<p>Maybe it&#8217;s me, but when I read the paper, I immediately thought of it as describing an Assurance Game.  Is there a reason you didn&#8217;t more formally articulate the choices facing the take-down firms game-theoretically?  It seems as though you &#8212; in stark contrast to others doing related work &#8212; have actual data to use in constructing payoff matrices.</p>
<p>I don&#8217;t mean this to sound like a &#8220;Why didn&#8217;t you write the paper I would have written?&#8221; comment.  My very sincere apologies if it does.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Martijn Grooten</title>
		<link>http://www.lightbluetouchpaper.org/2008/10/16/non-cooperation-in-the-fight-against-phishing/comment-page-1/#comment-29901</link>
		<dc:creator>Martijn Grooten</dc:creator>
		<pubDate>Thu, 16 Oct 2008 16:38:53 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=440#comment-29901</guid>
		<description>Good work! And let&#039;s hope the take-down companies will follow your advice. I&#039;m not sure where the anti-virus industry would have been without strong cooperation, but perhaps the virus threat would have been so immense, people would have gone back to writing important documents in longhand.</description>
		<content:encoded><![CDATA[<p>Good work! And let&#8217;s hope the take-down companies will follow your advice. I&#8217;m not sure where the anti-virus industry would have been without strong cooperation, but perhaps the virus threat would have been so immense, people would have gone back to writing important documents in longhand.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

