[WEB SECURITY] Re: Minimal User Interaction with Links

Bil Corry bil at corry.biz
Mon Aug 17 14:18:29 EDT 2009


51l3n73y3s wrote on 8/17/2009 12:14 PM: 
> You got it wrong too.The certificate is popping right after the "google"
> search, not after clicking on any of the links. I have attached the
> screenshot at the bugzilla link mentioned before.

Google includes a prefetch link for the search first result which causes Firefox to prefetch the URL.  You can disable this behavior in Firefox by going to "about:config", filter on "network.prefetch-next" and set it to "false".  More info here:

	http://kb.mozillazine.org/Network.prefetch-next
	https://developer.mozilla.org/en/Link_prefetching_FAQ

That second URL mentions pre-fetching on HTTPS was originally disabled for security reasons, but in FF3.5 was enabled.  Perhaps you could make the argument that it should be disabled again via your bug.


- Bil


----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA



More information about the websecurity mailing list