Recently, the Shmoo Group discovered that Firefox is vulnerable to precisely the exploit that i predicted in my 2002 paper—Ping

➡

How is it that Pet Names don’t solve this problem?—Mark

➡

Pet names only solve the problem as long as users are not allowed to type URLs into the location bar.—Ping

➡

Not at all. They can type any URL they like into the URL-location field. The issue is then, what is displayed in the Pet Name location field?—Mark

➡

The use case is surely where you see www.xn--paypal-4ve.com first and assign that the pet name "paypal"?—Ben

➡

How did you come to see www.xn--paypal-4ve.com ?—Mark

➡

It arrived in an email.—Ben

➡

Does your email reader render it as a link?—Mark

➡

And so we can go round this loop again. You propose to "fix" this problem by removing all meaning from the URL.—Ben

➡

Great question.—marcs

➡

I’m new to all this, so maybe I’m thinking about things the wrong way, but my first impression is that—David

➡

I believe all we’re trying to do and in fact all we can do is to enhance the safety of communication like:

"<I> (who you have some trust in) assert <this> about this other <entity>"

If by technical means we can enhance the safety of the knowledge of <I> and <entity> and the communication about any such assertion, <this>, then I believe we’ve enhanced human communication—whatever else one might say about the foibles of such communication. This seems to me a worthy cause—made somewhat more tractable in the digital realm.—Jed