Mozilla Drops Support for International Domains (Firfox)

Slashdot ^ | 2005-02-15 | Slashdot

[N3WBI3]

Netcraft has the story that Mozilla has decided to drop support for international domain names in future versions of its Firefox Web browser. The decision comes after demonstrations by the Schmoo Group that the feature can be used to aid in phishing scams and other browser naughtiness." From the article: "The attack can be disabled in Firefox and Mozilla by setting 'network.enableIDN' to false in the browser's configuration (enter about:config in the address bar to access the configuration functions). The Mozilla development team today made this the default setting. Users who want IDN support will be able to turn it on, but will be warned about the risks involved."

[N3WBI3]

Did not take long for the firefox people to address the problem. Personally I would have preferred something more infunction (like a different color address bad when an IDN address was up). As I dont contribbute to the project who am I to complain, the setting is off by default and a warning is in place when you turn it on. Its about the best they could do considering that this is a protocal problem with Windows and OSX..

Time to actually address this problem about a week..

[N3WBI3]

Looks like they are going to turn of IDN until at least 1.1 when they hope ot have a more perminate fix in place..

[TommyDale]

So is this Bill Gates' fault, too?

[need_a_screen_name]

Okay, I need to download Firefox. I've put it off long enough. Where is the best and most current download at?


Thanks

[Izzy Dunne]

Funny - the one case where Windows IE is NOT vulnerable and other browsers (including my favorite, Safari) are. I guess there are benefits to not following standards, after all.

Of course, if you don't click on those "send-me-your-bank-number-so-we-can-verify-your-account" messages, you're better off, anyway.

[kevkrom]

So is this Bill Gates' fault, too?

Nope. The IDN standard is broken (allows for spoofing in addresses), and removing support for the feature until the standard is fixed is the prudent thing to do.

[ThinkDifferent]

Okay, I need to download Firefox. I've put it off long enough. Where is the best and most current download at?

http://www.mozilla.org/products/firefox/

[N3WBI3]

No, and nobody ever said it was. Infact its a problem with the way MS and OSX implement a standard (This does not affect Linux). Here I put up a post about firefox and mention nowhere in it Bill gates or a specific problem with windows and you come on in and post this?

If you're not bright enough to contribute to the conversation its more polite to just stay silent.. Dang windows shills are like Canadians always acting on their P**is envy..

[kevkrom]

Okay, I need to download Firefox. I've put it off long enough. Where is the best and most current download at?

You should be able to find the latest and greatest at mozilla.org

[N3WBI3]

Izzy,

Yes and no. If you install and IDN plugin for Internet explorer it is just as vulnerable. The solution of the firefox folks (turning it off) is similar to the MS solution.

[Griptilian]

Time to actually address this problem about a week..

Is that some sort of spin or have you had your head in the sand for 6+ weeks?

[Ben Ficklin]

You won't be pleased with it when you reload FR threads.

[jigsaw]

about:config in the address bar to access the configuration functions

Hey, that's cool!

[TommyDale]

I was being sarcastic. Lately, anything wrong with internet functionality seems to bring out the anti-Gates crowd. My Firefox network.enableIDN is already set to "false" since this news came out several days ago.

[need_a_screen_name]

Thanks! Download commencing.

[NonValueAdded]

Just for grins, I tried the about:config command in my Netscape browser. I found the network.enableIDN setting and set it to false just to see what happens to my browsing experience.

I was very intrigued by the following setting:

privacy.popups.default_whitelist default string
aol.com,bankofamerica.com,carsdirect.com,cnn.com,compuserve.com,digitalcity.com,ea.com,mapquest.com,match.com,netscape.com

Look at some of the names in that list! BoA, CNN, carsdirect, match.com, etc.

What do you find in firefox and mozilla???

[need_a_screen_name]

"You won't be pleased with it when you reload FR threads."


Doesn't refresh pages well?

[N3WBI3]

I could be wrong but this issue came up last week (I have been deep in papers this week so it might be two). Iwent to secunia to check and the Vulnerability was released on 02-07-2005, a whopping eight days ago..

[So Cal Rocket]

Doesn't refresh pages well?

In IE, when you're at the "bottom" of a thread, and after you refresh, you're looking at the post you last looked at, with the "new" content below

In Firefox, after you refresh, you're at the bottom of the refreshed page, and you have to scroll back up to find where you left off.

[N3WBI3]

I find that you can confiure them yourself, by default there is no whitelist. You at some point clicked (allow popups from this site) and that put them there.