Client side username/password credential protection

1. A method of protecting username/password credentials, comprising the steps of:

providing a client computer that cooperates with an anti-phishing scheme that generates a client warning at the client computer when a suspected phishing website issues a username/password request;

generating, at the client computer, a set of S fake username/password credentials when said client warning is heeded;

generating, at the client computer, a set of (S−1) fake username/password credentials derived from a client-supplied username/password credential provided after said client warning is ignored; and

transmitting from the client computer to the suspected phishing website one of (i) said set of S fake username/password credentials, and (ii) said client-supplied username/password credential and said set of (S−1) fake username/password credentials.

2. A method according to claim 1 , wherein each of said S fake username/password credentials is unique, and wherein said S fake username/password credentials are correlated to one another.

3. A method according to claim 1 , wherein each of said (S−1) fake username/password credentials is unique, and wherein said (S−1) fake username/password credentials are correlated to one another.

4. A method according to claim 1 , further comprising the step of randomly positioning said client-supplied username/password within said set of (S−1) fake username/password credentials prior to said step of transmitting.

5. A method according to claim 1 , wherein (S−1)≧2.

6. A method according to claim 1 , wherein S≦10.

7. A method according to claim 1 , wherein said step of generating said S fake username/password credentials comprises the steps of:

creating a first of said S fake username/password credentials; and

creating a remainder of said S fake username/password credentials by sequential applications of a substitution rule wherein a first of said sequential applications uses said first of said S fake username/password credentials.

8. A method according to claim 1 , wherein said step of generating said (S−1) fake username/password credentials includes sequential applications of a substitution rule wherein a first of said sequential applications uses said client-supplied username/password credential.

9. A method of protecting username/password credentials, comprising the steps of:

providing a client computer with an internet web browser having at least one anti-phishing scheme operating therein, wherein each said scheme generates a client warning at the client computer when a suspected phishing website issues a username/password request;

generating, at the client computer, a set of S fake username/password credentials when said client warning is heeded, wherein 3≦S≦10;

generating, at the client computer, a set of (S−1) fake username/password credentials derived from a client-supplied username/password credential provided after said client warning is ignored;

randomly positioning said client-supplied username/password within said set of (S−1) fake username/password credentials; and

transmitting from the client computer to the suspected phishing website one of (i) said set of S fake username/password credentials, and (ii) said set of (S−1) fake username/password credentials with said client-supplied username/password credential positioned therein.

10. A method according to claim 9 , wherein each of said S fake username/password credentials is unique, and wherein said S fake username/password credentials are correlated to one another.

11. A method according to claim 9 , wherein each of said (S−1) fake username/password credentials is unique, and wherein said (S−1) fake username/password credentials are correlated to one another.

12. A method according to claim 9 , wherein said step of generating said S fake username/password credentials comprises the steps of:

creating a first of said S fake username/password credentials; and

creating a remainder of said S fake username/password credentials by sequential applications of a substitution rule wherein a first of said sequential applications uses said first of said S fake username/password credentials.

13. A method according to claim 9 , wherein said step of generating said (S−1) fake username/password credentials includes sequential applications of a substitution rule wherein a first of said sequential applications uses said client-supplied username/password credential.

14. A method of protecting username/password credentials, comprising the steps of:

providing a client computer with an internet web browser having at least one anti-phishing scheme operating therein, wherein each said scheme generates a client warning at the client computer when a suspected phishing website issues a username/password request, and wherein said client warning requires a selection of one of a first response that heeds said client warning and a second response that ignores said client warning;

generating, at the client computer, a correlated set of S fake username/password credentials when said first response is selected, wherein said correlated set of S fake username/password credentials is based on a rule;

generating, at the client computer, a correlated set of (S−1) fake username/password credentials derived from a client-supplied username/password credential provided after said second response is selected, wherein said correlated set of (S−1) fake username/password credentials is based on said rule; and

transmitting from the client computer to the suspected phishing website one of (i) said correlated set of S fake username/password credentials, and (ii) said client-supplied username/password credential and said correlated set of (S−1) fake username/password credentials.

15. A method according to claim 14 , further comprising the step of randomly positioning said client-supplied username/password within said (S−1) fake username/password credentials prior to said step of transmitting.

16. A method according to claim 14 , wherein (S−1)≧2.

17. A method according to claim 14 , wherein S≦10.

18. A method according to claim 14 , wherein said step of generating said S fake username/password credentials comprises the steps of:

creating a first of said S fake username/password credentials; and

creating a remainder of said S fake username/password credentials by sequential applications of said rule wherein a first of said sequential applications uses said first of said S fake username/password credentials.

19. A method according to claim 14 , wherein said step of generating said (S−1) fake username/password credentials includes sequential applications of said rule wherein a first of said sequential applications uses said client-supplied username/password credential.

20. A method according to claim 14 , further comprising the steps of:

providing a computer with said rule, the computer maintaining a database of legitimate username/password credentials;

receiving, at the computer, a username/password submission from a source;

generating, at the computer, a correlated set of possible username/password credentials derived from said username/password submission using said rule when said username/password submission does not match one of said legitimate username/password credentials; and

comparing said correlated set of possible username/password credentials with said database of legitimate username/password credentials wherein a match between one of said possible username/password credentials and one of said legitimate username/password credentials is indicative of said username/password submission originating from said one of (i) said set of S fake username/password credentials and (ii) said set of (S−1) fake username/password credentials.

21. A method according to claim 14 , wherein said rule is a substitution rule, and wherein each username and each password in said set of S fake username/password credentials is unique.

22. A method according to claim 14 , wherein said rule is a substitution rule, and wherein each username and each password in said set of (S−1) fake username/password credentials is unique.

23. A method of protecting username/password credentials, comprising the steps of:

providing a client computer with an internet web browser having at least one anti-phishing scheme operating therein, wherein each said scheme generates a client warning at the client computer when a suspected phishing website issues a username/password request, and wherein said client warning requires a selection of one of a first response that heeds said client warning and a second response that ignores said client warning;

generating, at the client computer, a correlated set of S fake username/password credentials when said first response is selected, wherein 3≦S≦10 and wherein said correlated set of S fake username/password credentials is based on a rule;

generating, at the client computer, a correlated set of (S−1) fake username/password credentials derived from a client-supplied username/password credential provided after said second response is selected, wherein said correlated set of (S−1) fake username/password credentials is based on said rule;

randomly positioning said client-supplied username/password within said correlated set of (S−1) fake username/password credentials; and

transmitting from the client computer to the suspected phishing website one of (i) said correlated set of S fake username/password credentials, and (ii) said correlated set of (S−1) fake username/password credentials with said client-supplied username/password credential positioned therein.

24. A method according to claim 23 , wherein said step of generating said S fake username/password credentials comprises the steps of:

creating a first of said S fake username/password credentials; and

creating a remainder of said S fake username/password credentials by sequential applications of said rule wherein a first of said sequential applications uses said first of said S fake username/password credential.

25. A method according to claim 23 , wherein said step of generating said (S−1) fake username/password credentials includes sequential applications of said rule wherein a first of said sequential applications uses said client-supplied username/password credential.

26. A method according to claim 23 , further comprising the steps of:

providing a computer with said rule, the computer maintaining a database of legitimate username/password credentials;

receiving, at the computer, a username/password submission from a source;

generating, at the computer, a correlated set of possible username/password credentials derived from said username/password submission using said rule when said username/password submission does not match one of said legitimate username/password credentials; and

comparing said correlated set of possible username/password credentials with said database of legitimate username/password credentials wherein a match between one of said possible username/password credentials and one of said legitimate username/password credentials is indicative of said username/password submission originating from said one of (i) said set of S fake username/password credentials and (ii) said set of (S−1) fake username/password credentials.

27. A method according to claim 23 , wherein said rule is a substitution rule, and wherein each username and each password in said set of S fake username/password credentials is unique.

28. A method according to claim 23 , wherein said rule is a substitution rule, and wherein each username and each password in said set of (S−1) fake username/password credentials is unique.

29. A method of protecting username/password credentials, comprising the steps of:

providing a client computer with an internet web browser having at least one anti-phishing scheme operating therein, wherein each said scheme generates a client warning at the client computer when a suspected phishing website issues a username/password request, and wherein said client warning requires a selection of one of a first response that heeds said client warning and a second response that ignores said client warning;

generating, at the client computer, a correlated set of S fake username/password credentials when said first response is selected, wherein said correlated set of S fake username/password credentials is based on a rule;

generating, at the client computer, a correlated set of (S−1) fake username/password credentials derived from a client-supplied username/password credential provided after said second response is selected, wherein said correlated set of (S−1) fake username/password credentials is based on said rule;

transmitting from the client computer to the suspected phishing website one of (i) said correlated set of S fake username/password credentials, and (ii) said client-supplied username/password credential and said correlated set of (S−1) fake username/password credentials;

providing a website computer that maintains a database of legitimate username/password credentials;

receiving, at the website computer, a username/password submission from a source;

generating, at the website computer, a correlated set of possible username/password credentials derived from said username/password submission using said rule when said username/password submission does not match one of said legitimate username/password credentials; and

comparing, at the website computer, said correlated set of possible username/password credentials with said database of legitimate username/password credentials wherein a match between one of said possible username/password credentials and one of said legitimate username/password credentials is indicative of the source being a suspected phishing website.

30. A method according to claim 29 , further comprising the step of randomly positioning said client-supplied username/password within said (S−1) fake username/password credentials prior to said step of transmitting.

31. A method according to claim 29 , wherein (S−1)≧2.

32. A method according to claim 29 , wherein S≦10.

33. A method according to claim 29 , wherein said step of generating said S fake username/password credentials comprises the steps of:

creating a first of said S fake username/password credentials; and

creating a remainder of said S fake username/password credentials by sequential applications of said rule wherein a first of said sequential applications uses said first of said S fake username/password credentials.

34. A method according to claim 29 , wherein said step of generating said (S−1) fake username/password credentials includes sequential applications of said rule wherein a first of said sequential applications uses said client-supplied username/password credential.

35. A method according to claim 29 , wherein said rule is a substitution rule, and wherein each username and each password in said set of S fake username/password credentials is unique.

36. A method according to claim 29 , wherein said rule is a substitution rule, and wherein each username and each password in said set of (S−1) fake username/password credentials is unique.