<story><title>Chrome 19 doesn&apos;t respect basic auth details embedded in the URL</title><url>http://code.google.com/p/chromium/issues/detail?id=123150</url></story><parent_chain></parent_chain><comment><author>michiel3</author><text>This technique is widely abused by phishers. Most browsers detect such phishing attacks and warn the user for it (see example in Safari 5).&lt;p&gt;Firefox might do a better job on this subject: it performs a HEAD request first, to see if the website actually requires authentication. If not, the user receives a warning to make the user aware of a potential phishing attack they might have been trapped into.</text></comment>
<story><title>Chrome 19 doesn&apos;t respect basic auth details embedded in the URL</title><url>http://code.google.com/p/chromium/issues/detail?id=123150</url></story><parent_chain></parent_chain><comment><author>avbor</author><text>&lt;a href=&quot;http://support.microsoft.com/kb/834489&quot; rel=&quot;nofollow&quot;&gt;http://support.microsoft.com/kb/834489&lt;/a&gt;&lt;p&gt;I remember reading about Microsoft stopping supporting that option actually. The reasoning being that it could be used for sending users to malicious sites.&lt;p&gt;&quot;malicious users can use this URL syntax together with other methods to create a link to a deceptive (spoofed) Web site that displays the URL to a legitimate Web site in the Status bar, Address bar, and Title bar of all versions of Internet Explorer.&quot;&lt;p&gt;I&apos;m wondering if this was the reasoning for doing so in Chrome.</text></comment>