Evaluating a trial deployment of password re-use for phishing prevention

We propose a scheme that exploits scale to prevent phishing. We show that while stopping phishers from obtaining passwords is very hard, detecting the fact that a password has been entered at an unfamiliar site is simple. Our solution involves a client that reports Password Re-Use (PRU) events at unfamiliar sites, and a server that accumulates these reports and detects an attack. We show that it is simple to then mitigate the damage by communicating the identities of phished accounts to the institution under attack. Thus, we make no attempt to prevent information leakage, but we try to detect and then rescue users from the consequences of bad trust decisions. The scheme requires deployment on a large scale to realize the major benefits: reliable low latency detection of attacks, and mitigation of compromised accounts. We harness scale against the attacker instead of trying to solve the problem at each client. In [13] we sketched the idea, but questions relating to false positives and the scale required for efficacy remained unanswered. We present results from a trial deployment of half a million clients. We explain the scheme in detail, analyze its performance, and examine a number of anticipated attacks.