Slashdot Mirror
Mozilla Drops Support for International Domains
tsu doh nimh writes "Netcraft has the story that Mozilla has decided to drop support for international domain names in future versions of its Firefox Web browser. The decision comes after demonstrations by the Schmoo Group that the feature can be used to aid in phishing scams and other browser naughtiness." From the article: "The attack can be disabled in Firefox and Mozilla by setting 'network.enableIDN' to false in the browser's configuration (enter about:config in the address bar to access the configuration functions). The Mozilla development team today made this the default setting. Users who want IDN support will be able to turn it on, but will be warned about the risks involved."
They've disabled it by default until they come up with a long term solution. That's hardly dropping.
There's a difference between "drops support" and "sets that option to 'off' by default", you know.
You can't take the sky from me...
It will be turned of in the 1.0.1 But for 1.1 and further releases they will look for a more cleaner way to fix the spoofing issue. And thus brining back IDN support. Here is a link to the Mozillazine article: http://www.mozillazine.org/talkback.html?article=6 073
Isn't this the "fix" that everyone found stopped working after you restarted the browser?
"People that quote themselves in their signatures bother me" - athakur999
From Chris Smith via BoingBoing
1) Goto your Firefox address bar. Enter about:config and press enter. Firefox will load the (large!) config page.
2) Scroll down to the line beginning network.enableIDN -- this is International Domain Name support, and it is causing the problem here. We want to turn this off -- for now. Ideally we want to support international domain names, but not with this problem.
3) Double-click the network.enableIDN label, and Firefox will show a dialog set to 'true'. Change it to 'false' (no quotes!), click Ok. You are done.
4) Go check out the shmoo demo again and notice it no longer works.
It is good that after all the media news about Firefox actually having a security issue that the team moved to correct it, even if very short term. Unfortunetly I don't think this will get as much media coverage as the previous stories on it, but it is a step in the right direction. So, at least we don't have to wait for a fix, they will disable the issue, fix it, then reinable it. Sounds like good software development to me.
Not .cx!!?!? Don't drop support for .cx!!!
Wouldn't rendering the characters in question as black-on-red in the status and location bar be a more effective solution? Or the entire background changes to red to warn the user that the characters they can read aren't the "actual" characters in the domain name?
This was discussed before, but the temporary fix, of setting it to off, doesn't work in current versions. Apperently the setting wasn't reloaded when the browser was restarted. I hope they fix that as well. In the mean time, please do NOT recommend the temporary fix to people, because it makes them think they are safe when they are not!
-- these are only opinions and they might not be mine.
What's this "international" thing people keep talking about?
It's where you go to fight wars.
Seriously, it says it RIGHT THERE. I quote:
"This is obviously an unsatisfactory solution in the long term and it is hoped that a better fix can be developed in time for Firefox 1.1,"
I found hard to beleive a serious project like Firefox would drop IDNs so easily. It's a huge world, you know.
Perhaps some of the international versions of Mozilla will have Int'l name _enabled_ by default. A quick peek at $CHARSET would do.
The submitter SHOULD have mentioned that Mozilla has decided to disable internationalIZED domain names, ones made of "funny" unicode characters.
.uk .au, and our favorite, .cx, are of course still supported.
International domain names like
Has anyone actually seen a legitimate IDN in the wild?
With most of the phishing scams targeted at English-speaking users, I don't see this as such a horrible decision.
p
In Korea, long hair is for old people!
This isn't about turning off domains like .kr. Rather, it's about turning off Unicode support in domain names - currently, in browsers which support IDN, it's possible to send someone to a URL which looks like "https://www.paypal.com" but really has a letter replaced with a non-English Unicode character which looks the same. This deactivation turns off support for Unicode domain names, not national domains.
That's it. I'm no longer part of Team Sanity.
have they not read this?
MilkMiruku
Doesn't Slashdot have editors that are supposed to analyze and edit user postings. "Dropping" and "disabling" mean two different actions. I got confused for a second or two. Lately, Slashdot quality has been going down the tubes.
In Soviet Russia, dirty foreigner is you
Ahhhh...the point of the scam is a domain name that looks like www.paypal.com in your browser but redirects you to something eeeeevil.
See the pretty demo.
Why don't they just make it obvious you're visiting an IDN? Similar to how they handle SSL sites, the location bar background turns yellow. Maybe for IDNs, they can make it red and flashing or something similar, so it's obvious to the user that something may be wrong. Maybe they could check and see if there is an equivalent looking domain name in english and then making it red and flashing to let the user know that it may not be the site they think they're visiting.
There just seems to be other ways to handle it, since it really is more of a 'user beware' issue.
Things you think are in the Constitution, but are not.
D. J. Bernstein (djbdns, qmail, ...) saw this problem coming back in 2002. He proposed an alternative to IDNA called IDNC3 which he claimed wouldn't cause this kind of mess. Looks like nobody listened to him though.
The problem is that you can't always easily identify an international domain name. In particular, IDNs contain characters that are nearly identical to Latin character set but are treated differently. Slashdot won't let me put in examples, but examples here.
The paypal.com one is particularly scary. It looks like paypal.com in your status bar when you hover over the link. It reads paypal.com in your address bar. But it isn't Paypal. That's because the "a" isn't an "a" but is really Unicode D0B0 If they'd put any effort into making it look like Paypal, it would be easy for somebody to direct you there and steal your Paypal password.
In Firefox and IE they're indistinguishable. Even if they added a clue that something was different (e.g. colors to indicate an IDN) you'd have to look closely, and if IDNs became common you'd start to ignore the color coding. If the only difference between "paypal.com" and an identical spoof were small, you'd get tired of looking closely, and forget. If the warning was unignorable, like a popup, you'd turn it off.
So the upshot is, yeah, beware of web sites you don't know, but with IDNs you don't always know whom you know.
No, no, no. IDN's aren't about country codes, they're about special character codings that result in things in your status bar that look like their ASCII equivalent characters, but aren't.
Don't worry, that special site hosted in Christmas Island will continue to resolve just fine. :)
Not International domain names. Internationalized domain names.
Well, you wouldn't trust a site that doesn't present a valid certificate. The problem is that obtaining such is too expensive for many.
We need a reliable way for the a domain owner to get a certificate issued for that domain. This is mostly a bureaucratic problem, which could be solved, people willing.
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
A real solution for this problem is posted here
:-
/[^\x20-\xFF]/
The applicable part is:
1. Install the Adblock Firefox extension.
here
2. Look at the Adblock 'Preferences' and go to 'Adblock Options'
3. Tick 'Site Blocking'
4. Add the following filter
Necessity is the mother of invention.
Laziness is the father.
I feel your pain - how do so many long-winded comments spawn so quickly? Twenty minutes and the topic is washed up. I can only assume it's all a trick to get you to buy the subscription.
There are websites that use IDN characters... IN JAPAN!
Singularity: a belief in the "God" idea with the "demiurge" relation inverted.
From your home directory, enter the .mozilla/firefox/*.default folder; then with vim open compreg.dat, and search for the string: "idn-service;1" (use the / function). Change the 1 to 0 in both the strings you find. Now, restart Firefox.
The url will still appear spoofed at the bottom-left corner of the browser, but if you click on the proof-of-concept link it won't work.
It's like curing calluses by chopping the legs off. It's about time that someone with a brain came in and fixed this phishing problem once and forever. Disabling international domains is not a solution. Remember, majority of the population of this planet doesn't speak English. Why should they NOT use their native alphabet?
Think about it: the aim of the IDN is so that the native readers of a non-ASCII language can use domains which make sense to them. If ASCII doesn't make sense, then what about the ".com"?
This whole IDN thing was designed improperly. I can't imagine why the designers didn't bother to take a look at the myriad character sets floating around out there. Just a cursory glance at the Unicode book would have given them second thoughts.
It's used to send me money, of course.
Thanks,
Qal
paintball
It isn't IDN that's broken, it's users who don't read carefully before clicking a button.
Karma: It's all a bunch of tree-huggin' hippy crap!
The solution to this whole mess is so simple! Just use numeric addresses!
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
American? Hmm. Lead Developer was in my class in Auckland, New Zealand.
dominionrd.blogspot.com - Restaurants on
I've been a long-time web user, can speak French and German, have done a lot of trawling German sites for information, yet had no idea that anything other than ASCII was available for URLs. I think it's a good solution for most English speakers, especially monolingual English speakers until something better can be worked out.
I’m old enough to remember 16K of memory being described as “whopping”