233865 - URL: DNS: very long domain name (VLDN) as spoofing

Status: RESOLVED WORKSFORME

(Firefox :: Address Bar, defect)

Description

[benc]

(mentioned in several places, including bug 232567#c2)

A URL that has a very long domain name can sometimes be used to deceive a user:

The general confusion is created by either user ignorance of the URL syntax
(where does the hostname begin and end?) and is possibly aided by UI that
truncates the hostname.

http://www.microsoft.com.windows.2000.badsite.com

There are several aspects of this that should be noted.

1- what are valid characters in the hostname? are there characters that could be
used to suggest, visually, that a hostname has ended (when syntactically it has
not)?
2- are UI elements doing any unescaping or filtering of hostname charaacters
that change the displayed URL -or- confuse users?
3- are there UI elements that are truncating (edge of text box or "..." after a
certain length)?

If necessary to avoid drift, if these items become full blown issues that need
to be fixed via patch, lets break out new bugs quickly.

NOTE:
This threat is probably a lower priority than the other two issues (bug 232567
and bug 122445), because in most cases there is a clear line of authority both
for who configured the spoof, and who can turn it off. A hostmaster would have
to either delgate a subdomain or have made the configuration themselves. The
spoofing domain is likely a trademark or other intelectual property violation
that can be quickly addressed through legal channels, and/or cutting off the
offending domain at the TLD.

Comment 1

[Jan Ruzicka]

There is also problem with showing long URLs at all.
See bug 265551 .

Comment 3

[Marco Bonardo [:mak]]

Considering the lock indicators, the control panel and the url hilighting, I'm not sure if this bug deserves to still be around.
If it would have some suggested actions or actionable item, then it may be useful but like this... May we close it?

Comment 4

[Daniel Veditz [:dveditz]]

We've introduced many anti-spoofing measures over the years. Probably can do more but we'd need more specific enhancement bugs.