From: "Rich" 

This is a multi-part message in MIME format.

------=_NextPart_000_0067_01C58470.DFE0C360
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

   Your claims conflict with reports from secunia such as =
http://secunia.com/advisories/15488/ which states

  Secunia Research has discovered a vulnerability in Opera, which can be =
exploited by malicious web sites to spoof dialog boxes.

  The problem is that JavaScript dialog boxes do not display or include =
their origin, which allows a new window to open e.g. a prompt dialog = box,
which appears to be from a trusted site.

Opera had a vulnerability explicitly targeting address bar spoofing.  =
From http://secunia.com/advisories/11532/

  Secunia has discovered a vulnerability in the Opera browser, which can =
be exploited by malicious people to fake (spoof) information displayed = in
the address bar.

And other at http://secunia.com/advisories/11901/

  The issue may be caused due to a race condition and will sometimes =
make it possible to display spoofed information in the address bar via a =
specially crafted HTML document.

Wait, there's another at http://secunia.com/advisories/12028/

  bitlance winter has discovered a vulnerability in the Opera browser, =
which potentially can be exploited by malicious people to conduct =
phishing attacks against a user.

  The problem is that information in the address bar is changed before =
properly loading a page

And another at http://secunia.com/advisories/12162/

  bitlance winter has discovered a vulnerability in the Opera browser, =
which potentially can be exploited by malicious people to conduct =
phishing attacks against a user.

  The problem is that Opera fails to update the address bar=20

So clearly your claims are inaccurate.  Maybe you meant to state that =
current versions of opera threw a lot of spackle on the architectural =
security chasms of opera and how opera provides a high bandwith gateway =
to the heart of the OS.  More likely you are just up to your typical = mike
miller propaganda spreading FUD.

Rich

  "Mike '/m'"  wrote in message =
news:3mgvc1le67479k4v72baee6vkfajvrhgro{at}4ax.com...
  On Fri, 08 Jul 2005 20:10:07 -0400, Mike N. 
  wrote:

  >On Fri, 08 Jul 2005 17:55:09 -0400, Mike '/m'  =
wrote:
  >
  >>>there's no way to secure older browsers to the same level.  =20
  >>
  >>I don't know if you should be so absolute.
  >
  >  ... with qualifiers of course: same level with Javascript enabled, =
etc.

  I still you are too absolute.   For example, in my quick reading of =
the
  article, one of the exploits was to place a nicely formed windows over
  the address bar of the browser, blocking out the address.  Opera would
  open that window in a new tab.  There is also a checkbox in Opera's
  config that says to always show the source URL of Javascript boxes, =
even
  when the Javascript says otherwise.

  But my main point is that XPSP2 threw a lot of spackle on the
  architectural security chasms in IE.  I remain to be convinced that
  other browsers need that spackle in order to be as secure as IE*.  For
  starters, on IE presents the hackers with a high-bandwidth gateway =
into
  the heart of the OS.  None of the other browsers are so intermingled
  with the operating system.

   /m


  * - "as secure as IE", amazing that I could type that without putting =
a
  smiley in there...


------=_NextPart_000_0067_01C58470.DFE0C360
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable








   Your
claims conflict with =
reports from=20
secunia such as http://secunia.com/advisori" target="new">http://secunia.com/advisori=">http://secunia.com/advisories/15488/">http://secunia.com/advisori=
es/15488/ which=20
states
 

  Secunia Research has discovered a =
vulnerability in=20
  Opera, which can be exploited by malicious web sites to spoof dialog=20
  boxes.The problem is that JavaScript dialog boxes do not =
display or=20
  include their origin, which allows a new window to open e.g. a prompt =
dialog=20
  box, which appears to be from a trusted =
site.
 
Opera had a vulnerability explicitly =
targeting=20
address bar spoofing.  From http://secunia.com/advisori" target="new">http://secunia.com/advisori=">http://secunia.com/advisories/11532/">http://secunia.com/advisori=
es/11532/
 

  Secunia has discovered a vulnerability in =
the Opera=20
  browser, which can be exploited by malicious people to fake (spoof)=20
  information displayed in the address
bar.
 
And other at http://secunia.com/advisori" target="new">http://secunia.com/advisori=">http://secunia.com/advisories/11901/">http://secunia.com/advisori=
es/11901/
 

  The issue may be caused due to a race =
condition and=20
  will sometimes make it possible to display spoofed information in the =
address=20
  bar via a specially crafted HTML
document.
 
Wait, there's another at http://secunia.com/advisori" target="new">http://secunia.com/advisori=">http://secunia.com/advisories/12028/">http://secunia.com/advisori=
es/12028/
 

  bitlance winter has discovered a =
vulnerability in the=20
  Opera browser, which potentially can be exploited by malicious people =
to=20
  conduct phishing attacks against a user.The problem is that=20
  information in the address bar is changed before properly loading a=20
  page
 
And another at http://secunia.com/advisori" target="new">http://secunia.com/advisori=">http://secunia.com/advisories/12162/">http://secunia.com/advisori=
es/12162/
 

  bitlance winter has discovered a =
vulnerability in the=20
  Opera browser, which potentially can be exploited by malicious people =
to=20
  conduct phishing attacks against a user.The problem is that =
Opera=20
  fails to update the address bar 
 
So clearly your claims are =
inaccurate.  Maybe=20
you meant to state that current versions of opera threw a lot of spackle = on the=20
architectural security chasms of opera and how opera provides a high = bandwith=20
gateway to the heart of the OS.  More likely you are just up to = your=20
typical mike miller propaganda spreading FUD.
 
Rich
 

  "Mike '/m'" <mike{at}barkto.com>=20">mailto:mike{at}barkto.com">mike{at}barkto.com>=20
  wrote in message news:3mgvc1le674=
79k4v72baee6vkfajvrhgro{at}4ax.com...On=20
  Fri, 08 Jul 2005 20:10:07 -0400, Mike N. <mike{at}u-spam-u-die.net>wr=">mailto:mike{at}u-spam-u-die.net">mike{at}u-spam-u-die.net>wr=
ote:>On=20
  Fri, 08 Jul 2005 17:55:09 -0400, Mike '/m' <mike{at}barkto.com>=20">mailto:mike{at}barkto.com">mike{at}barkto.com>=20
  wrote:>>>>there's no way
to secure older browsers =
to the=20
  same level.  
>>>>I don't know if you =
should be=20
  so absolute.>>  ... with
qualifiers of course: same =
level=20
  with Javascript enabled, etc.I still you are too =
absolute.  =20
  For example, in my quick reading of thearticle, one of the =
exploits was to=20
  place a nicely formed windows overthe address bar of the browser, =
blocking=20
  out the address.  Opera wouldopen that window in a new =
tab. =20
  There is also a checkbox in Opera'sconfig that says to always show =
the=20
  source URL of Javascript boxes, evenwhen the Javascript says=20
  otherwise.But my main point is that XPSP2 threw a lot of =
spackle on=20
  thearchitectural security chasms in IE.  I remain to be =
convinced=20
  thatother browsers need that spackle in order to be as secure as=20
  IE*.  Forstarters, on IE presents the hackers with a =
high-bandwidth=20
  gateway intothe heart of the OS.  None of the other browsers =
are so=20
  intermingledwith the operating =
system. /m* - "as=20
  secure as IE", amazing that I could type that without putting =
asmiley in=20
  there...

------=_NextPart_000_0067_01C58470.DFE0C360--

--- BBBS/NT v4.01 Flag-5