Firefox 3 Screen Mockups - One fix is no fix

One of the potential new features of Firefox 3 is that the location bar will be substantially changed. One of the changes possibly on the plate is to gray out all of the location bar except for the domain + tld of the content. I have two problems with this:

1) If mysite.com has an XSS vulnerability, attackers, rather than sending the user to another site, will typically use mysite.com itself to render the new page they want. So the result would look something like:
http://www.mygoodsite.com/redirect.foo?url=[maliciousscript]
See the image at http://people.mozilla.com/~faaborg/files/20070602-firefox3UIFeatures/locationBar.jpg
And it would look like I was visiting goodsite.com. Now, their reasoning for doing it was sound - sometimes when you visit a malicious site, they use visual cues in the location bar to make you think you're not at the malicious site.
2) The location bar doesn't tell you where all the content is coming from.

In the Business for Too Long

I think I've been in the business for too long. I distrust everybody. I went camping last weekend, and as I'm walking back to the site from taking out some trash, a complete stranger walks up to me and starts making conversation.

CS: Well, I guess I'll stay on for another week.
What's his angle?
SV: Really? How long you been here for?
Maybe he's just making small talk....
CS: Well, since the last week of March.
What's his angle?
SV: Really?
CS: Yeah - got my RV parked here.
Maybe he's trying to make small talk. Guess I'll make small talk.
SV: Really? You in the permanent resident area?
CS: Naw. Parked over here. Pay by the week.
What's his angle? Time to hit eject.
SV: Hmm...
CS: Yeah - paying $120 a week.
Okay - really time to hit eject, but this is too intriguing. It is a holiday weekend.
SV: Really? That's dirt cheap compared to what I'm paying for a tent site per night.
Okay - really oughn't have said that. What's his angle again?
CS: Well, it is when you're still making a house payment.
Wow! Was that his angle?
SV: Well, gotta run.

Now, the guy was really probably only making small talk. He probably had no malicious intent, and was probably not even looking for a handout. Those not in the field, or who are able to not take work home with them probably would have had a nice conversation with the guy. Maybe my bravo sierra meter goes a bit too high...

Nigel Tufnel: [pause] These go to eleven.

Beef up your browser against phishing attempts

Or then again, don't click links in emails or trust links on blogs.

It's really sad when those who have at least a modicum of technical savvy, who write blogs to those who generally don't, tell those who don't the very wrong thing to do. I'm not saying anti-phishing tools are inherently bad, but depending on them is.