Topic awaiting preservation: Spoofing with XUL (Page 1 of 1)

With XUL, it's possible to re-create the interface of website + some fake certificates and security label ( the little lock in the status bar ) to fake a sensitive site.

A demonstration of the technique is available, with a screenshot.

Scary, when someone is able to recreate any website an make this functioning they can mess up a lot...
Thank god there is a solution:

quote:

---

The obvious solution is to prevent Javascript from hiding the status bar by default. Secure out-of-the-box is a good thing. Microsoft is doing this to IE 6 SP2 finally.

However, even if you disallow Javascript from hiding the status bar and try it again, you'll see that it still looks nearly real. Maybe you or I won't be fooled, but I know my mother would be.

---

Something worth to check when you do online payments. To dissallow Javascript in FF to hide the statusbar Goto: Tools-->Options-->Web features-->Enable Javascript(with javascript off there is no problem) Choose the "advanced" button and remove the checkmark at "hide statusbar".
Personally i hae removed all chekmarks except the one to change images. I don't like people messing with my browser so i don't allow them to.

------------------------------
Support Justice for Pat Richard