Phishing protection

Phishing is a form of identity theft. It occurs when an evil site pretends to be a site that you trust (by copying its design) in order to steal your username and password.

idproxy.net includes two features to help you avoid being taken in by phishing attempts.

Your monster

When you create an account here, you get to pick a monster (yes, a monster; they're fun!) When ever you log in to the site, your monster will greet you by name. A phishing site will not be able to duplicate this as they will not know what your monster looks like (there is a chance they could guess your name). If your monster isn't there, you could be in trouble!

A safe landing page

Unfortunately, OpenID is particularly vulnerable to phishing because when you log in to a site, it gets to redirect you to your OpenID provider. An evil site could instead show you a copy of your provider, and if you weren't paying close attention to your URL bar you could be taken in.

idproxy.net attempts to reduce this risk by not displaying a log-in form on the page that other sites redirect you to. Instead, you are encouraged to manually browse to idproxy.net; we recommend using a bookmark for this purpose. If an OpenID consuming site ever redirects you to idproxy.net and the page you arrive at contains a form or link of any kind, that site is a malicious imitation.

You can read more about this approach in this blog entry.