Re: SSL MITM fun.

[Robert Święcki <robert () swiecki net>]

> However, the countermeasures browsers have implemented are trivial to bypass.
> It only took me an hour to find a number of variations of the homograph attack
> that still work. Here's a spoofed google.com page (over SSL for bonus points)
> that works on the latest version of Firefox 3 on Mac OS X:
>
> https://www.google.xn--com-edoaaaaaaaaaaaaaaaaaaaaaaaaaaaa.phreedom.org/

You can find the list of blacklisted IDN characters in firefox's

about:config

one of the idn.something.blacklist keys

If the character you used is not listed there, you should report it to
mozilla, if it is, then there must be an implementation bug hiding
somewhere in FF.

-- 
Robert Święcki
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave