Security and identification indicators for browsers against spoofing and phishing attacks

Amir Herzberg, Ahmad Jbara

Research output: Contribution to journalArticlepeer-review

79 Scopus citations


In spite of the use of standard Web security measures (SSL/TLS), users enter sensitive information such as passwords into fake Web sites. Such fake sites cause substantial damages to individuals and corporations. In this work, we identify several vulnerabilities of browsers, focusing on security and identification indicators. We present improved security and identification indicators, as we implemented in TrustBar, a browser extension we developed. With TrustBar, users can assign a name or logo to identify SSL/TLS-protected sites; if users did not assign a name or logo, TrustBar identifies protected sites by the name or logo of the site, and by the certificate authority (CA) who identified the site. We present usability experiments which compared TrustBar's indicators to the basic indicators available in most browsers (padlock, URL, and https prefix), and some relevant secure-usability principles.

Original languageEnglish (US)
Article number16
JournalACM Transactions on Internet Technology
Issue number4
StatePublished - Sep 1 2008
Externally publishedYes


  • Human-computer interaction
  • Phishing
  • Secure usability
  • Web spoofing

ASJC Scopus subject areas

  • Computer Networks and Communications


Dive into the research topics of 'Security and identification indicators for browsers against spoofing and phishing attacks'. Together they form a unique fingerprint.

Cite this