Bugtraq mailing list archives
Re:Re: [ELEYTT] 3SIERPIEN2007
From: "Michal Bucko" <michal.bucko () eleytt com>
Date: Sat, 04 Aug 2007 23:10:44 +0200
"[..]it's counterproductive to bash Firefox.[..]"
I have no intension of bashing Firefox. However, in my opinion, such link obfuscation touches effectively every man in the street, and a web browser should tackle a problem in a different way. (differnt treatment of misguiding URL elements, problem of direct linking, etc.)
"[..]javascript: might be somewhat counterintuitive and can be used for obfuscation, but are otherwise displayed properly in the status bar.[..]"
This is exactly what I meant - I am definetely not saying that URL is being wrongly displayed. What I am saying is that it might cause a problem for normal users (and it will).
"[..]We might argue that there should be no confusing
URL schemes, or that direct linking to them should be restricted, but that's again a wholly separate academic debate[..]" I agree.
"[..]It's not a Firefox problem[..]"
The origin of the issue, as you noticed, probably lies somewhat lower, in the notion of security. (e.g. who should be protected and to what extent?) As I mentioned before, normal users should be given a chance to cope (with more efficacy) with such misguiding issues. Finally, according to my notion of security, we should build such solutions so that normal users do not need to learn much about RFC standards to make use of a web browser. Such scripts are tangible proofs of a larger problem concerning the notion of security. As you said, this is a subject for a longer discussion. mb
Current thread:
- [ELEYTT] 3SIERPIEN2007 Michal Bucko (Aug 03)
- Re: [ELEYTT] 3SIERPIEN2007 Michal Zalewski (Aug 04)
- <Possible follow-ups>
- Re: [ELEYTT] 3SIERPIEN2007 Michal Bucko (Aug 04)
- Re: [ELEYTT] 3SIERPIEN2007 Michal Zalewski (Aug 06)
- Re:Re: [ELEYTT] 3SIERPIEN2007 Michal Bucko (Aug 06)
- Re: [ELEYTT] 3SIERPIEN2007 xyborg (Aug 09)
- Re:Re: [ELEYTT] 3SIERPIEN2007 Michal Bucko (Aug 10)