Doesn't solve the problem of users without smart phones though, which I imagine is still not ignorable at most universities.
The next step would be to filter outbound traffic to block SMTP from compromised PCs. It seems they have an outbound firewall, but it's not obvious which ports are closed because the list of blocked ports is ... blocked[1].
[0] http://blogs.oucs.ox.ac.uk/adamweblearn/2011/12/weblearn-una...
You're a lecturer with 200 people in your class. That's 2 days. Does the lecturer have to leave their computer all the time? Is their email programme going to handle this sort of delay? What do you do if the lecturer wants to send an email about updated homework due in a few days? Some students will have a 2 day head start, is that fair? Do you have to give them extra time/marks?
You're the first year faculty advisor. There are 1,000 people in that year. That's 1 week. Same questions as above.
(And in case you think "Well let the lecturers send more", what makes you think the lecturers aren't the problem in the first place?)
Calls for Papers / Articles is the classic reason. The IEEE and the ACM might have proper mailing lists for that sort of business ... most academic fields do not.
Edit: I think they could lower the rate more and push mailing lists, but on the other hand a lot of users simply wouldn't notice that they're rate limited. Which could lead to entirely different brand of lulz.
Additionally, what OSes will these dongles support? Would you rather "Oxford University bans Windows XP"? or "Oxford University bans iPhones"? etc.
As far as email, there are several things to consider: One, that I would think it a rarity for a student, or even a teacher! to need to send a single email to more than a handful of /external/ email addresses at a time. Put an email firewall in place between your internal and external systems, and have IT security monitor that system for peaks in traffic. Single users sending outbound mail a lot. Obviously, there should be a spam filter going in AND out.
And yes, spam email does trickle in sometimes, and from different SMTP servers, but from the bit I've dealt with them, there are definite patterns that a person can pick up on when they're watching for it.
This demonstrably doesn't work. It reduces but cannot eliminate all instances of phishing.
> Don't give your users credentials. Have some alternate way to authenticate them like a login token.
Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a university, no matter how famous.
> Put rate limiting on the ability of a single account to send out emails.
Many users have legitimate reasons to send out mass emails.
> Instead of blocking the site that was collecting the credentials, a better solution would have been to remove the email from the mailboxes of all the students.
Phishing emails are often varied into multiple templates to avoid being scrubbed this way.
They also tend to trickle in at random, rather than turning up all at once.