The importance of online authentication cannot be overstated: it is what allows us to determine with whom we are communicating online.  Browsers have historically shown a “green lock icon” next to a domain name to indicate something about the security of that website—but far less security than many users give it credit for.  In this talk, I will present evidence that attackers are increasingly exploiting the misplaced trust that users place in security indicators to launch more sophisticated phishing attacks.  I will also discuss potential future directions for solving this problem.  This is joint work with students Richard Roberts and Yaelle Goldschlag.