[ILUG] Firefox/Mozilla/Opera exploit

[Brian Foster]

  | Date: Mon, 14 Feb 2005 10:56:39 +0000
  | From: Colm MacCarthaigh <colm at stdlib.net>
  | Subject: Re: [ILUG] Firefox/Mozilla/Opera exploit
  | 
  | On Mon, Feb 14, 2005 at 10:52:22AM -0000, Conor Wynne wrote:
  |  > This is pretty shocking, and on FC3 I cannot tell the difference
  |  > between the real paypal and the faked one.
  | 
  | It's only shocking if you havn't been paying attention for about 4
  | years, when this kind of thing was first identified.

  yep.  IMHO, the “shocking” thing here is the more actively
 developed browsers, released long after the 2001 CACM paper,
 have the problem to begin with.  that paper was short and
 clear.  there does not seem to be an excuse for having the
 problem with browsers released years (literally!) later.

  knowledge of the general problem, albeit perhaps not the
 URL and e-address examples(/exploits), predates that CACM
 paper.  I distinctly rememeber reading about the problem
 in a Sun book about Java (predating JDK 1.2, AFAICR),
 albeit there the context was identifiers in Java code.

  of course, the much older issue of broadly similar glyphs
 is very well-known: 0 vs. O, 1 vs. 1, and so on.

cheers!
	-blf-
-- 
Experienced (20+ yrs) kernel/software Eng: | Brian Foster   Montpellier,
 • Unix, embedded, &tc;  • Linux;  • doc;  | blf at utvinternet.ie   FRANCE
 • IDL, automated testing, process, &tc.   |  Stop E$$o (ExxonMobile)!
Résumé (CV) http://www.blf.utvinternet.ie  |     http://www.stopesso.com