As readers here would be aware, many online threats can be mitigated by disabling Javascript and cookies on untrusted websites. However, phishing can still be achieved with a static HTML page that masquerades as the target page. All that is required is CSS to style the page, and an HTML form where the user types their password.

In the thread discussing Exploratirum's phishing attack today, a few ideas to mitigate phishing threats were mentioned / proposed:

  * Two factor authentication
  * A browser extension that checks whether a known
    password is being used on an unknown website.
  * Browser extensions such as lastpass can prevent
    phishing indirectly because the password is based on
    window.location.origin
  * Security images, which are not very effective as per [1]

### Idea: Block forms by default

Much like the option of blocking cookies and/or javascript by default, if browsers prevented form actions by default then a majority of phishing attacks could be prevented.

User might type in the password on an unknown site, but if the form action was prevented (in addition to javascript), the site wouldn't receive the password and the user would be alerted to it.

Thoughts?

  [1]: http://security.stackexchange.com/questions/19155/