319397 - [security] display non-standard unicode adress characters in a different color

Status: RESOLVED DUPLICATE of bug 279099

(Firefox :: General, enhancement)

Description

[ozzy]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8) Gecko/20051111 Firefox/1.5

In phishing, a method that is employed is to use the cyrillic character o in stead of the western o, thus directing users to another site.

If the background of the adressbar would change to another color, to show that the adress is not written in the western unicode set or if THAT character would be displayed in a different color (that stands out) then the user would have visual feedback that he might not be looking at the site he think he has requested.

(not sure, how unicode characters are worked out in DNS, so I am not sure what the best method would be)

Another solution often heard is to just not use non-standard unicode adresses, but that would not be so good for all the non-western users of firefox (allthough it could be an extra function, sort of a paranoia-mode)

Reproducible: Always

Comment 1

[ozzy]

BTW,

I think this should be a configurable option, so:
One option would be to change the highlighting in de addressbar (either single char of complete bar) -> set by default
Another option would be to only allow addresses that use system-standard unicode or western standard unicode. (semi-paranoia-mode)
Another option would be to disallow addresses that use non-system-standard unicode. (paranoia-mode)

Comment 2

[zug_treno]

Related to/duplicate of Core bug 279099?

Comment 3

[ozzy]

(In reply to comment #2)
> Related to/duplicate of Core bug 279099?
> 

It looks like it (searched only via bug summary and did not know this was known as punycode. It would be a great feature though. Not sure of what the outcome of that bug would be.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** This bug has been marked as a duplicate of 279099 ***