Recently, the Shmoo Group discovered that Firefox is vulnerable to precisely the exploit that i predicted in my 2002 paper—Ping

➡

The central point of my essay on the petname toolbar is that phishing is the result of name conflation.—Tyler

➡

So how, in this system, does the user come to trust Paypal (as opposed to someone pretending to be Paypal)?—Ben

➡

If I’m understanding the discussion so far, I think the answer is that the issue of trust is separate from the issue of identity.—Jed

➡

A website that says "this is the Paypal website" all over it, perhaps? —Ben

That wouldn’t induce me (at least) to use a name like Paypa1 (note the digit one = 1 vs. the letter "l"). Doing so could only result in confusion. It might induce me to establish a trust relationship with whatever identity I choose to give the site (e.g. NewPaypal or perhaps it’s the first "Paypal" that I’ve assigned an identity for and I choose "Paypal" as the Petname for this site. However, assigning any trust to such a site based on it’s saying "this is the Paypal website" would be foolish.—Jed