This low key mention of a new explorer flaw has serious implications. If you are a Windows MSIE user, see how easy it is to be fooled, just pretend the following page is an official looking pop-up, email, forum posting, or any link at all: demo page. Did it trick for you, no matter how tight your browser and firewall sercurity was set? More info on Phishing .. see this page at the FTC).

The implications are serious, (or joyous, for the phishers), already adept at setting up look-alike pages, they may now disguise the full location as well. Before now, the location field was a key giveaway. It may also be possible to fake the user into an https (secure) site, one that offers the re-assurance of the padlock symbol.

Solution? 1. Wait for the microsoft patch. 2. Switch to firebird, mozilla, or Opera (ask the nearest trustworthy 13 year old to help you if you're concerned about how difficult it is) 3. Use a Macintosh. 4. Never enter sensitive data into a form on a site unless you are 100% sure the site is not just a cardboard front. Visit e-commerce sites from bookmarks, be wary of "offers" or "requests" originating from emails, spam, pop-ups, or anything else. And once there, Right button .. view .. properties, to verify the domain name is correctly displayed, or turn on and eyeball the MSIE Status Bar. (View .. Status Bar).

Update: In the follow-up remarks, this BBR member demonstrated how it will also work with https URLs as well - you look at a "paypal" link - you go to "paypal" - it shows the "padlock" - and the right Address as well - but it is not paypal!

Update: AOL 8.0 browser does the right thing, as one would expect as their browser is closely related to Mozilla.

The regulars in our Security forum helped with this demo.