Defending Against Phishing Attacks

Valuable information, such as user authentication credentials and personal sensitive information, can be obtained by exploiting vulnerabilities within the user’s understanding of a system, and particularly a lack of understanding of the user interface. As the barrier to exploiting system vulnerabilities has increased significantly with time, attacking users has rapidly become a more efficient and effective alternative. To protect users from phishing attacks system designers and security professionals need to understand how users interact with those attacks. In this thesis I present an improved understanding of the interaction and three novel mechanisms to defend against phishing attacks.