More importantly, is something that Microsoft could do to make IE's phishing filter work better at protecting users' privacy? After all, you can disable it if y

More importantly, is something that Microsoft could do to make IE's phishing filter work better at protecting users' privacy? After all, you can disable it if you don't like it, but having it off just increases your vulnerability to another kind of privacy problem. It is a similar problem to OCSP vs. CRLs for X.509 (SSL/TLS) certificates. CRLs are better for the end-user's privacy in the sense that the protocol doesn't tell the CA what websites the user is actually browsing, while OCSP (as implemented today) does. But, OCSP allows something more like real-time certificate status checks, and CRL information will almost always be more out of date.