Re:Re: [ELEYTT] 3SIERPIEN2007 Aug 04 2007 09:10PM
Michal Bucko (michal bucko eleytt com)
> "[..]it's counterproductive to bash Firefox.[..]"

I have no intension of bashing Firefox. However, in
my opinion, such link obfuscation touches effectively
every man in the street, and a web browser should tackle
a problem in a different way. (differnt treatment of
misguiding URL elements, problem of direct linking, etc.)

> "[..]javascript: might be somewhat counterintuitive
> and can be used for obfuscation, but are otherwise
> displayed properly in the status bar.[..]"

This is exactly what I meant - I am definetely not
saying that URL is being wrongly displayed. What I
am saying is that it might cause a problem for
normal users (and it will).

> "[..]We might argue that there should be no confusing

URL schemes, or that direct linking to them should be

restricted, but that's again a wholly separate

academic debate[..]"

I agree.

> "[..]It's not a Firefox problem[..]"

The origin of the issue, as you noticed, probably lies
somewhat lower, in the notion of security. (e.g. who
should be protected and to what extent?) As I mentioned
before, normal users should be given a chance to cope
(with more efficacy) with such misguiding issues.

Finally, according to my notion of security, we should
build such solutions so that normal users do not need
to learn much about RFC standards to make use of a web
browser. Such scripts are tangible proofs of a larger
problem concerning the notion of security. As you said,
this is a subject for a longer discussion.


[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus