As mentioned in
this article, mozilla drops Internationalized Domain Names (IDN) specification due to a flaw in the system.
Back in 2001 some people thought it would be smart to allow unicode/utf in domainnames so you can actualy have a domain in your foreign language like russian or japanese (you can register them). However at the moment almost none dynamic website supports these kinds of urls unless you use special html characters like &#[number];.
phpBB and some other systems use the html characters to convert non-compliant ansii code if possible. However Dragonfly goes beyond this system by supporting unicode/utf out of the box so you can use any character easily.
But by using these kind of special characters or unicode there pops up a flaw in domain names since 2001...
Verisign has pushed IDN the last 4 years so that every browser accepts IDN domains these days (except IE since that browser never had new features since 1998, only bugfixes and options to fix security issues). Due to IDN you may register domainnames with special characters that look exactly like the US ANSII characters and that way you, sort of, fake a domain.
fake paypal.com (spoofed) and the official paypal
If you are using a browser like Mozilla, Firefox, Opera or Safari, then the first link should direct you to strange website although it looks like it's paypal.
Now you go guess whichone is real when someone just copy/pasted the official paypal website.
This is the reason why mozilla drops the support because these days a lot people try to spoof important websites.
shmoo.com has registered that fake paypal site to show the issue and bring to the people with a reallife example.
Keep in mind that when the issue is solved with IDN, our system will be fully compliant to the latest standards which will give us another head start compared to our competitors.
Posted by DJMaze on Wednesday, February 16, 2005 (05:27:59) (5957 reads)
Re: Mozilla Drops IDN Support Due to Flaw
(Score: 1 )
by Jeruvy on Thursday, March 03, 2005 (02:21:07)
(User Info | Send a Message)
Keep in mind the REAL culprit here is Verisign not thinking before they leap and allowing IDN before it was truly ready for prime time, in other words....
Looking at the Chinese market and drooling with both lips.
Instead of focusing on the issues. Of course the resulting exploits have been coming ALSO from China at a fast and furious pace. So let the Phishing contest begin!!