Skip to Content
Uncategorized

Microsoft to break Internet Explorer’s handling of some URLs to improve security.

A web browser’s URL can encode a username and a password, using a URL that looks like this:http(s)://username:password@server/resource.extUnfortunately, it turns out that numerous hackers have discovered that you can create a URL that looks like this:https://www.paypal.com…………………………………….. …………………….. ………………………… ……..:……. @badserver.com/and…

A web browser’s URL can encode a username and a password, using a URL that looks like this:


http(s)://username:password@server/resource.ext


Unfortunately, it turns out that numerous hackers have discovered that you can create a URL that looks like this:


https://www.paypal.com.................
...........................
..........................
..............................
........:....... @badserver.com/


and most people won’t see the periods and will, instead, think that they are logging into the Paypal server.

This Microsoft Knowledgebase article gives warning that “Microsoft plans to release a software update that modifies the default behavior of Internet Explorer for handling user information in HTTP and HTTPS URLs.”

The software will be released through Windows Update, which means that it will be picked up very fast. Of course, this patch also means that Microsoft will be breaking some customer URLs.

Important points here:

1. The user:password@host syntax never really caught on. Instead, cookie-based authentication did, as did browsers caching usernames and passwords, so most people won’t be adversely affected.

2. It’s interesting that Microsoft is increasing breaking features to improve security.

3. You should be paying attention to the fact that Microsoft now has this interesting ability to change software out in the field. So far they’ve only used this power for security updates. This is one of the first times that they’ve used it to remove a working feature.

Keep Reading

Most Popular

AGI is just chatter for now concept
AGI is just chatter for now concept

The hype around DeepMind’s new AI model misses what’s actually cool about it

Some worry that the chatter about these tools is doing the whole field a disservice.

Workers disinfect the street outside Shijiazhuang Railway Station
Workers disinfect the street outside Shijiazhuang Railway Station

Why China is still obsessed with disinfecting everything

Most public health bodies dealing with covid have long since moved on from the idea of surface transmission. China’s didn’t—and that helps it control the narrative about the disease’s origins and danger.

Europe's AI Act concept
Europe's AI Act concept

A quick guide to the most important AI law you’ve never heard of

The European Union is planning new legislation aimed at curbing the worst harms associated with artificial intelligence.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.