Simson Garfinkel

A View from Simson Garfinkel

Microsoft to break Internet Explorer's handling of some URLs to improve security.

A web browser’s URL can encode a username and a password, using a URL that looks like this:http(s)://username:password@server/resource.extUnfortunately, it turns out that numerous hackers have discovered that you can create a URL that looks like this:https://www.paypal.com…………………………………….. …………………….. ………………………… ……..:……. @badserver.com/and…

  • February 2, 2004

A web browser’s URL can encode a username and a password, using a URL that looks like this:


http(s)://username:password@server/resource.ext


Unfortunately, it turns out that numerous hackers have discovered that you can create a URL that looks like this:


https://www.paypal.com.................
...........................
..........................
..............................
........:....... @badserver.com/


and most people won’t see the periods and will, instead, think that they are logging into the Paypal server.

This Microsoft Knowledgebase article gives warning that “Microsoft plans to release a software update that modifies the default behavior of Internet Explorer for handling user information in HTTP and HTTPS URLs.”

The software will be released through Windows Update, which means that it will be picked up very fast. Of course, this patch also means that Microsoft will be breaking some customer URLs.

Important points here:

1. The user:password@host syntax never really caught on. Instead, cookie-based authentication did, as did browsers caching usernames and passwords, so most people won’t be adversely affected.

2. It’s interesting that Microsoft is increasing breaking features to improve security.

3. You should be paying attention to the fact that Microsoft now has this interesting ability to change software out in the field. So far they’ve only used this power for security updates. This is one of the first times that they’ve used it to remove a working feature.

Uh oh–you've read all of your free articles for this month.

Insider Premium
$179.95/yr US PRICE

Want more award-winning journalism? Subscribe and become an Insider.
  • Insider Premium {! insider.prices.premium !}*

    {! insider.display.menuOptionsLabel !}

    Our award winning magazine, unlimited access to our story archive, special discounts to MIT Technology Review Events, and exclusive content.

    See details+

    What's Included

    Bimonthly home delivery and unlimited 24/7 access to MIT Technology Review’s website.

    The Download. Our daily newsletter of what's important in technology and innovation.

    Access to the Magazine archive. Over 24,000 articles going back to 1899 at your fingertips.

    Special Discounts to select partner offerings

    Discount to MIT Technology Review events

    Ad-free web experience

    First Look. Exclusive early access to stories.

    Insider Conversations. Listen in as our editors talk to innovators from around the world.

  • Insider Plus {! insider.prices.plus !}* Best Value

    {! insider.display.menuOptionsLabel !}

    Everything included in Insider Basic, plus ad-free web experience, select discounts to partner offerings and MIT Technology Review events

    See details+

    What's Included

    Bimonthly home delivery and unlimited 24/7 access to MIT Technology Review’s website.

    The Download. Our daily newsletter of what's important in technology and innovation.

    Access to the Magazine archive. Over 24,000 articles going back to 1899 at your fingertips.

    Special Discounts to select partner offerings

    Discount to MIT Technology Review events

    Ad-free web experience

  • Insider Basic {! insider.prices.basic !}*

    {! insider.display.menuOptionsLabel !}

    Six issues of our award winning magazine and daily delivery of The Download, our newsletter of what’s important in technology and innovation.

    See details+

    What's Included

    Bimonthly home delivery and unlimited 24/7 access to MIT Technology Review’s website.

    The Download. Our daily newsletter of what's important in technology and innovation.

/
You've read all of your free articles this month. This is your last free article this month. You've read of free articles this month. or  for unlimited online access.