Mozilla Drops IDN Support Due to Flaw

February 2005

Mozilla developers are closing the door on phishing schemes that exploit a widely reported flaw in the Internationalized Domain Names (IDN) specification. Upcoming builds of Firefox 1.0.1, Mozilla 1.7.6 and Mozilla 1.8 beta will have IDN disabled as a temporary corrective measure to protect users from identity theft.

IDN is presently enabled by default in Firefox, Mozilla, Opera, and Apple's Safari Web browsers. Microsoft's Internet Explorer does not have native IDN support and therefore is not affected by the problem.

The flaw permits malicious users to "spoof" legitimate Web pages by taking advantage of how some Web browsers handle the Unicode unified character set utilized by IDN. A specially crafted link can mimic a trusted URL in a browser's address bar, SSL certificate and status bar, but take the user to another location.

Unicode is the globally recognized replacement for the US English only ASCII standard.