Non non non, il suffit d'aller sur le site de la démo et de faire un effort pour lire le texte - oui c'est de l'anglais:
What will NOT fix this particular problem (...)
* Placing a certificate's OU or trusted domain in the status bar, location bar, or anywhere else (see Bug 245406). As the bad guy, I have complete control over everything on the screen (well, almost). Any extra displays can be faked just as easily as the location bar was faked. (If you think coloring the location bar [Bug 244025] solves this problem, think again. I can do colors with about 2 lines of CSS).
-----> une coloration, un domaine ou un cadenas ne changeront rien
* Blocking access to (parts or all of) chrome:// from remote websites. While that would make the bad guy's job harder, he can still instruct Firefox to load all the relevant XULs from his webserver. As it is, I had only to provide a couple XULs (browser.xul and a somewhat-merged pageInfo.xul/PageInfoOverlay.xul). Total download: less than 100kb. Everything else comes from local chrome:// stuff.
-----> il peut reprendre tes marques-pages, tes préférences particulières
* Relying on this message. I bypass it by assembling the form-submit URL in Javascript.
-----> un message d'avertissement ne change rien
C'est la fin du monde !!
C'est la vengeance du grand Bill ?
"La liberté est à l'homme ce que les ailes sont à l'oiseau" Jean-Pierre Rosnay
[^] # Re: Pas seulement firefox...
Posté par ZeroHeure . En réponse à la dépêche Nouvelle forme d'arnaque : l'usurpation d'identité de site web via XUL. Évalué à 5.
Non non non, il suffit d'aller sur le site de la démo et de faire un effort pour lire le texte - oui c'est de l'anglais:
What will NOT fix this particular problem (...)
* Placing a certificate's OU or trusted domain in the status bar, location bar, or anywhere else (see Bug 245406). As the bad guy, I have complete control over everything on the screen (well, almost). Any extra displays can be faked just as easily as the location bar was faked. (If you think coloring the location bar [Bug 244025] solves this problem, think again. I can do colors with about 2 lines of CSS).
-----> une coloration, un domaine ou un cadenas ne changeront rien
* Blocking access to (parts or all of) chrome:// from remote websites. While that would make the bad guy's job harder, he can still instruct Firefox to load all the relevant XULs from his webserver. As it is, I had only to provide a couple XULs (browser.xul and a somewhat-merged pageInfo.xul/PageInfoOverlay.xul). Total download: less than 100kb. Everything else comes from local chrome:// stuff.
-----> il peut reprendre tes marques-pages, tes préférences particulières
* Relying on this message. I bypass it by assembling the form-submit URL in Javascript.
-----> un message d'avertissement ne change rien
C'est la fin du monde !!
C'est la vengeance du grand Bill ?
"La liberté est à l'homme ce que les ailes sont à l'oiseau" Jean-Pierre Rosnay