Microsoft has released a security patch that solves one of the more vexing problems faced by internet merchants - URL spoofing. URL spoofing allows a scammer to easily deceive an internet user into thinking that the website that they are viewing is actually run by a reputable company. For example, here is a sample of the type of URL that scammers have been using -
(yes I munged the URL, but I didn't purposely misspell the
first occurence of the word "Information"
in the URL, the scammer did that ;)
Unless you look closely and know what to look for, you can't really tell that this is a spoofed URL that directs you to visit a counterfeit website run by a scammer (usually for the purpose of fooling you into provide credit card or banking information).
Microsoft has finally taken action to prevent this type of deception from working inside of its Internet Explorer web browser.
"A
security update is available that removes support for handling user
names and passwords in HTTP and HTTP with Secure Sockets Layer (SSL) or
HTTPS URLs in Microsoft Internet Explorer. The following URL syntax is
no longer supported in Internet Explorer or Windows Explorer after you
install the MS04-004 Cumulative Security Update for Internet Explorer
(832894):
http(s)://username:password@server/resource.ext
...malicious users can use this URL syntax together with other methods to create a link to a deceptive (spoofed) Web site that displays the URL to a legitimate Web site in the Status bar, Address bar, and Title bar of all versions of Internet Explorer."
I was hoping that MS and the other browser makers would go this route. The syntax is rarely handy and its potential for abuse is huge - scratch that, it is probably being abused more than its being properly used.
This goes a long way towards solving a number of problems that others have been trying to address in policy-space. (ie - ICANN Whois task forces and similar fora). Removing the technical capability removes the potential for abuse instead of just applying a bandaid at a policy level.
This is the way the internet is supposed to work.
