Worrying Paypal...

[pubjoe]

A couple of things...
1. What the hell? I didn't think address bar faking was possible under IE... then again I recall the null byte exploit. I think what happens is the link shows up fine in your address bar but screws up when shown in the status bar... which is why it's hidden.

I've just looked at the html, and actually, It's very simple, not much javascript involved, but I never thought of it. They just hid the address bar in the header, and then made a little table at the top of the page that had this in it:

<INPUT id=newAddr 
            style="font-size: 8pt; background-image: url('ie2.gif'); width: 100%; background-repeat: no-repeat; height: 22; background-position: left top" 
            size=50 value='      https://www.paypal.com/cgi-bin/webscr?cmd=_login-run' name=no class="indent">

So simple really, but it matched my top bar so well that I didn't notice.

 

[MegatronUK]

Dont click on links in emails.

Please.