Slashdot Mirror
Mozilla Drops Support for International Domains
tsu doh nimh writes "Netcraft has the story that Mozilla has decided to drop support for international domain names in future versions of its Firefox Web browser. The decision comes after demonstrations by the Schmoo Group that the feature can be used to aid in phishing scams and other browser naughtiness." From the article: "The attack can be disabled in Firefox and Mozilla by setting 'network.enableIDN' to false in the browser's configuration (enter about:config in the address bar to access the configuration functions). The Mozilla development team today made this the default setting. Users who want IDN support will be able to turn it on, but will be warned about the risks involved."
They've disabled it by default until they come up with a long term solution. That's hardly dropping.
There's a difference between "drops support" and "sets that option to 'off' by default", you know.
You can't take the sky from me...
It will be turned of in the 1.0.1 But for 1.1 and further releases they will look for a more cleaner way to fix the spoofing issue. And thus brining back IDN support. Here is a link to the Mozillazine article: http://www.mozillazine.org/talkback.html?article=6 073
Isn't this the "fix" that everyone found stopped working after you restarted the browser?
"People that quote themselves in their signatures bother me" - athakur999
Not .cx!!?!? Don't drop support for .cx!!!
What's this "international" thing people keep talking about?
It's where you go to fight wars.
Perhaps some of the international versions of Mozilla will have Int'l name _enabled_ by default. A quick peek at $CHARSET would do.
The submitter SHOULD have mentioned that Mozilla has decided to disable internationalIZED domain names, ones made of "funny" unicode characters.
.uk .au, and our favorite, .cx, are of course still supported.
International domain names like
This isn't about turning off domains like .kr. Rather, it's about turning off Unicode support in domain names - currently, in browsers which support IDN, it's possible to send someone to a URL which looks like "https://www.paypal.com" but really has a letter replaced with a non-English Unicode character which looks the same. This deactivation turns off support for Unicode domain names, not national domains.
That's it. I'm no longer part of Team Sanity.
have they not read this?
MilkMiruku
5) Close all instances of Firefox, restart Firefox
6) Go check out the shmoo demo again and notice it works again.
This "fix" only works temporarily. Once you restart the browser, it reverts back to the original behavior.
TODO: Insert witty sig
In Soviet Russia, dirty foreigner is you
Yes, There are plenty, especially in Sweden and northern Europe. Take for example vävtak.se.
Anyway. I think this solution is truly bad. IDN is a fundamental change we need to the internet. Not only to incorporate local languages on to the Internet, but also to increase the number of available choices.
Disabling IDN is really bad. Instead, as suggested by someone else here, the registrars should prevent/ban addresses that will look the same on screen as existing ones.
In fact, couldn't Mozilla instead do a simple test and see if the domain name exists without the hidden characters. If it does then it should warn the user about it.
D. J. Bernstein (djbdns, qmail, ...) saw this problem coming back in 2002. He proposed an alternative to IDNA called IDNC3 which he claimed wouldn't cause this kind of mess. Looks like nobody listened to him though.
The problem is that you can't always easily identify an international domain name. In particular, IDNs contain characters that are nearly identical to Latin character set but are treated differently. Slashdot won't let me put in examples, but examples here.
The paypal.com one is particularly scary. It looks like paypal.com in your status bar when you hover over the link. It reads paypal.com in your address bar. But it isn't Paypal. That's because the "a" isn't an "a" but is really Unicode D0B0 If they'd put any effort into making it look like Paypal, it would be easy for somebody to direct you there and steal your Paypal password.
In Firefox and IE they're indistinguishable. Even if they added a clue that something was different (e.g. colors to indicate an IDN) you'd have to look closely, and if IDNs became common you'd start to ignore the color coding. If the only difference between "paypal.com" and an identical spoof were small, you'd get tired of looking closely, and forget. If the warning was unignorable, like a popup, you'd turn it off.
So the upshot is, yeah, beware of web sites you don't know, but with IDNs you don't always know whom you know.
No, no, no. IDN's aren't about country codes, they're about special character codings that result in things in your status bar that look like their ASCII equivalent characters, but aren't.
Don't worry, that special site hosted in Christmas Island will continue to resolve just fine. :)
Well, you wouldn't trust a site that doesn't present a valid certificate. The problem is that obtaining such is too expensive for many.
We need a reliable way for the a domain owner to get a certificate issued for that domain. This is mostly a bureaucratic problem, which could be solved, people willing.
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
A real solution for this problem is posted here
:-
/[^\x20-\xFF]/
The applicable part is:
1. Install the Adblock Firefox extension.
here
2. Look at the Adblock 'Preferences' and go to 'Adblock Options'
3. Tick 'Site Blocking'
4. Add the following filter
Necessity is the mother of invention.
Laziness is the father.
Nope. Did exactly that. about:config, clear cache, restart Firefox, test at secuna - wham. The spoof still works.
The Adblock method of stopping this (mentioned earlier) is a nice workaround. Adblock has become quite a useful tool.
Neurowiz
It's like curing calluses by chopping the legs off. It's about time that someone with a brain came in and fixed this phishing problem once and forever. Disabling international domains is not a solution. Remember, majority of the population of this planet doesn't speak English. Why should they NOT use their native alphabet?
It's used to send me money, of course.
Thanks,
Qal
paintball