lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <d97943baf0c753dcbaa1d09511538101.qmail@home.pl>
Date: Sat, 04 Aug 2007 23:10:44 +0200
From: "Michal Bucko" <michal.bucko@...ytt.com>
To: bugtraq@...urityfocus.com
Subject: Re:Re: [ELEYTT] 3SIERPIEN2007

> "[..]it's counterproductive to bash Firefox.[..]"

I have no intension of bashing Firefox. However, in
my opinion, such link obfuscation touches effectively
every man in the street, and a web browser should tackle 
a problem in a different way. (differnt treatment of 
misguiding URL  elements, problem of direct linking, etc.)



> "[..]javascript: might be somewhat counterintuitive 
> and can be used for obfuscation, but are otherwise 
> displayed properly in the status bar.[..]"

This is exactly what I meant - I am definetely not
saying that URL is being wrongly displayed. What I 
am saying is that it might cause a problem for 
normal users (and it will).


> "[..]We might argue that there should be no confusing
  
URL schemes, or that direct linking to them should be 
  
restricted, but that's again a wholly separate 
  
academic debate[..]"

I agree. 


> "[..]It's not a Firefox problem[..]"

The origin of the issue, as you noticed, probably lies
somewhat lower, in the notion of security. (e.g. who 
should be protected and to what extent?) As I mentioned 
before, normal users should be given a chance to cope
(with more efficacy) with such misguiding issues. 



Finally, according to my notion of security, we should 
build such solutions so that normal users do not need 
to learn much about RFC standards to make use of a web
browser. Such scripts are tangible proofs of a larger 
problem concerning the notion of security. As you said, 
this is a subject for a longer discussion.




mb

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ