| Date: Mon, 14 Feb 2005 10:56:39 +0000
| From: Colm MacCarthaigh <colm at stdlib.net>
| Subject: Re: [ILUG] Firefox/Mozilla/Opera exploit
| On Mon, Feb 14, 2005 at 10:52:22AM -0000, Conor Wynne wrote:
| > This is pretty shocking, and on FC3 I cannot tell the difference
| > between the real paypal and the faked one.
| It's only shocking if you havn't been paying attention for about 4
| years, when this kind of thing was first identified.
yep. IMHO, the “shocking” thing here is the more actively
developed browsers, released long after the 2001 CACM paper,
have the problem to begin with. that paper was short and
clear. there does not seem to be an excuse for having the
problem with browsers released years (literally!) later.
knowledge of the general problem, albeit perhaps not the
URL and e-address examples(/exploits), predates that CACM
paper. I distinctly rememeber reading about the problem
in a Sun book about Java (predating JDK 1.2, AFAICR),
albeit there the context was identifiers in Java code.
of course, the much older issue of broadly similar glyphs
is very well-known: 0 vs. O, 1 vs. 1, and so on.
Experienced (20+ yrs) kernel/software Eng: | Brian Foster Montpellier,
• Unix, embedded, &tc; • Linux; • doc; | blf at utvinternet.ie FRANCE
• IDL, automated testing, process, &tc. | Stop E$$o (ExxonMobile)!
Résumé (CV) http://www.blf.utvinternet.ie | http://www.stopesso.com
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!