bugtraq - Re: Firefox: about:blank is phisher's best friend

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0702172209040.21898@dione>
Date: Sat, 17 Feb 2007 22:16:27 +0100 (CET)
From: Michal Zalewski <lcamtuf@...ne.ids.pl>
To: zonafirefox@...il.com
Cc: bugtraq@...urityfocus.com
Subject: Re: Firefox: about:blank is phisher's best friend

On Sat, 17 Feb 2007 zonafirefox@...il.com wrote:

> I tested it in IE7 and has the same problem. Opera 9.10 blocks the
> opening of the new window but fails in the second button.

With MSIE7, it is possible only if you check 'Allow websites to open
windows without address or status bar' for that particular zone;
otherwise, all windows will have a minimal URL bar attached.

I'm not sure whether this setting is default - if it is, yeah, that'd be
bad for MSIE.

As far as Opera is concerned - by default, Javascript can't hide address
bars, and if you change this option, the originating URL is still
displayed.

/mz