Slashdot Mirror
Mozilla Drops Support for International Domains
tsu doh nimh writes "Netcraft has the story that Mozilla has decided to drop support for international domain names in future versions of its Firefox Web browser. The decision comes after demonstrations by the Schmoo Group that the feature can be used to aid in phishing scams and other browser naughtiness." From the article: "The attack can be disabled in Firefox and Mozilla by setting 'network.enableIDN' to false in the browser's configuration (enter about:config in the address bar to access the configuration functions). The Mozilla development team today made this the default setting. Users who want IDN support will be able to turn it on, but will be warned about the risks involved."
There's a difference between "drops support" and "sets that option to 'off' by default", you know.
You can't take the sky from me...
No they didn't. They temporarily changed the default. Support for it certainly is still there.
It is good that after all the media news about Firefox actually having a security issue that the team moved to correct it, even if very short term. Unfortunetly I don't think this will get as much media coverage as the previous stories on it, but it is a step in the right direction. So, at least we don't have to wait for a fix, they will disable the issue, fix it, then reinable it. Sounds like good software development to me.
Well, you wouldn't trust a site that doesn't present a valid certificate. The problem is that obtaining such is too expensive for many.
We need a reliable way for the a domain owner to get a certificate issued for that domain. This is mostly a bureaucratic problem, which could be solved, people willing.
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
Nope. Did exactly that. about:config, clear cache, restart Firefox, test at secuna - wham. The spoof still works.
The Adblock method of stopping this (mentioned earlier) is a nice workaround. Adblock has become quite a useful tool.
Neurowiz
It's like curing calluses by chopping the legs off. It's about time that someone with a brain came in and fixed this phishing problem once and forever. Disabling international domains is not a solution. Remember, majority of the population of this planet doesn't speak English. Why should they NOT use their native alphabet?
This is not a solution, it's a workaround. A solution would be something that allowed to use IDN sites without risk of phishing.
This will block any URL that uses characters outside the normal ASCII range.
So why was IDN created at all?
Singularity: a belief in the "God" idea with the "demiurge" relation inverted.
Pretend, also, that you occasionally use paypal.com. Wouldn't you like to see that the background changes from the familiar red to a soothing white for the real paypal link?
Making the colors configurable (maybe via two simple options: ``I regularly use IDN.'' and ``I don't usually use IDN.'') would take away most of the remaining objections.
``Simple and obvious'' does not mean ``wrong''.
See what I've been reading.
I dunno... when your entire security is dependent on the user being able to notice slight pixel changes on the screen, something seems a little broken...
No, that's an awful 'solution'. What about a domain name like http://www.m/#257;ori.co.nz/? I bet that doesn't even render correctly for you since you probably disabled international fonts too. Your stupid solution prevents people from accessing that site.
Or are countries supposed to not allow domain names to use characters from their language now? Chinese who don't speak a word of English are expected to guess an English version for local domains? I bet they'd like it as much as you'd like a new standard that only chinese characters are allowed in domain names since they are unambiguous.
Disabling international domain names is barely acceptable for a workaround. It sure isn't any sort of solution to the problem.