One thing that browsers could do now to help with this is add the concept of a domain bookmark, with a similar interface to EV but added by the user. Then the

One thing that browsers could do now to help with this is add the concept of a domain bookmark, with a similar interface to EV but added by the user. Then the user could a a domain bookmark of "My Bank" or whatever, and check for that when visiting any link claiming to be from your bank. Of course, banks like to use a bunch of random sounding domains so you need to do that a few times (when accessed via the main site)[note]. I check for a bookmark in firefox when typing a domain name, but something that works for the whole domain would be great. The same basic idea with email is helpful as well, creating a visual distinction for senders you expect to receive mail from and unknown senders. I don't think it is perfectly reliable due to issues with email but it does catch all phishing attempts that I've seen personally. The GNU Name System or similar would help in some cases, but I don't think it really solves this particular problem. To confirm that a site is one the user cares about, the best way to do that is for the user to indicate that a site is one they care about and then look for that in the future. Then they only need to get the correct site once. [note] Some banks would still defeat this by creating short term marketing campaign domains and then allowing them to expire... I guess to deal with that there would need to be a way to mark the main long term domain and give other domains the ability to ask a different domain to vouch for them as from the same organization. Then the user could just add one domain bookmark and it would just work for all other domains from that organization. At least unless the bank forgets to update that list before the domain expires...