So you are forcing all people to look at punycode all the time, even if that makes it worse? What if I have a punycode look alike domain? Yeah, that will make it harder I guess.
Nope, we're never going to display the punycode and Unicode at the same time. It'll always be one or the other, depending on whether we trust the TLD not to issue homographic domains to different people.
Now, you might wonder, do we really need this, yes we do, because my bank site (for example) makes use of a chromeless window, without navigation- and status bar, so I need to have a way of displaying the certificate info, or I would be lost and it would still very easy to deceive our users without this kind of information.
No, it doesn't make use of a window without the status bar, because the status bar is always-on in Firefox 1.0 and onwards.
- I don't think it's necessary to involve the whole "Master Password" thing. Most users don't use them anyway.
The question is, should we explain them why they need one, or do we wait till some ill extension writer steals your sensitive data?
How is this prevented by a Master Password? After you've typed the password in, the extension writer can then steal your data.
Bad extensions may be an issue, but they are unrelated to this one.
Did you consider adopting the UI suggestions in my paper?
I've said this before, and I keep repeating myself over and over again; go to a local school and ask young children what it is and you will find out that the 'silly character' suggestion doesn't stand long.
Not that one (I've rather gone off that idea); the ones in the "New Site" section I referred you to.
Also, using "new site" is a bit blurry to me
Is it a new domain name, are you visiting the site for the first time, didn't you store a key for it, did you clear your SSL History
The SSL history would not be clearable, and would always store the hash. So the meaning of the indicator is clear.
or are you using a different profile/computer system?
The indicator, fairly obviously, means that it's a new site for you on this computer. 99.99% of users don't use multiple profiles, and those who do tend to be technically competent, so I'm not worried about that case.
What about theme and extension authors, they can undo/change/hide this, so that won't work either.
Again, malicious extensions and themes are outside the scope of the discussion.
What if I hide my status bar? Are you (Mozilla Firefox) re-enabling "MY" statusbar, just to be able to display that silly lock and text again?
That's your choice to do so.
Think about this; John Doe visits https://www.majorbank.com in an Internet cafe, and you're next, right, you shouldn't visit your bank site in a public Internet Cafe, but that's what happens every day, more than you can imagine.
Ok, so now Jane Doe visits this Internet cafe, hopefully the owner is not a bad person, because they can already 'steal' lots of handy/important data for criminal use, anyway, she visits the same phishing site, without knowing it because she thinks that this is the right site, after all, there's no warning, right? So what happens to her money/bank account?
This is a problem for the Internet Cafe to deal with in their software configuration. E.g. EasyInternetCafe completely wipes the computer and restarts between customers; this action would (obviously) clear the SSL history. But there won't be a button or UI to do it.
Gerv _______________________________________________ Mozilla-security mailing list Mozilla-security@mozilla.org http://mail.mozilla.org/listinfo/mozilla-security
