Is Microsoft's Anti-Phishing Filter Spyware?

Some of the technical details behind Microsoft's upcoming anti-phishing filter are published in their Internet Explorer blog: http://blogs.msdn.com/ie/archive/2005/09/09/463204.aspx.

Phishing is when someone attempts to impersonate another website in an effort to obtain user's confidential data in order to commit fraud. Phishing is most commonly perpetrated via spam email campaigns. Paypal is an extremely popular target since obtaining user data is almost as good as cash.

The filter works by passing the names of certain unknown sites you visit on to a Microsoft server, which gives them the thumbs up or down. Only certain sites are relayed to Microsoft for approval. Websites that are known to be "good" (like msn.com) or don't have any other negative indicators are not passed back to the server.

The basic concept of operation is very similar to anti-spam DNS blacklists used to stop unwanted email. It's not clear if the exact mechanism used will be DNS or not.

One of the problems with this approach is that your system becomes reliant on yet another third-party for reliable information. A few years back one of the blacklists used by SpamButcher's mail blocker had serious problems. That's why the feature is off by default now.

Here's the concerning part. This mechanism would in effect tell Microsoft about many of the websites you are surfing. They of course claim not to store any personal information that could be tracked back to an individual user. Still, collecting aggregate information about millions of user's surfing habits just sounds a bit disturbing.

Back