Defeating active phishing attacks for web-based transactions

Till now, the best defense against phishing is the use of two-factor authentication systems. Yet this protection is short-lived and comparatively weak. The absence of a fool-proof solution against Man-inthe-Middle, or Active Phishing, attacks have resulted in an avalanche of security practitioners painting bleak scenarios where Active Phishing attacks cripple the growth of web-based transactional systems. Even with vigilant users and prudent applications, no solutions seem to have addressed the attacks comprehensively. In this chapter, the authors propose the new Two-factor Interlock Authentication Protocol (TIAP), adapted from the Interlock Protocol with two-factor authentication, which is able to defend successfully against Active Phishing attacks. They further scrutinize the TIAP by simulating a series of attacks against the protocol and demonstrate how each attack is defeated.