!!!Using IP addresses instead of URLs in Safari!!!

[robertjordanusa]

Hopefully everyone knows about this DNS server hacking scheme that is able to hack a DNS server and send millions of unwitting web surfers to cloned websites. A hacker could potentially clone a bank's website to perfection except for the login frame which would then send the hacker your user name and password and then forward you to the actual website unknowingly. The browser would just assume that they typed their name or password wrong. This could net a hacker millions of bank account logins in a matter of the first hour. This appears to me to be the MOST DANGEROUS exploit of the internet in history.

WHAT IS THE SOLUTION?
It would seem that the solution, barring a DNS server side fix, is to type in the actual IP address (ex. 159.53.64.54) for the secure sites that you wish to visit instead of using a URL "chase.com" The problem with this is that Safari always adds an *http://*159.53.64.54 to the beginning of the address disallowing you to use direct IP addresses.

*How can I type in a direct IP address into Safari, Firefox etc.?* Please let there be an answer.

 

[StealthRider]

HTTP is, as the name suggests, the protocol required to use the site you're attempting to visit. If you wanted to access an FTP IP, you would have to type ftp://

The addition of "http://" is not a problem. Oh, and that IP you showed doesn't actually work for anything.

 

[Queso]

Don't do this. Virtually every enterprise on the planet uses load balancing devices to ensure that each of their Internet facing servers does not become overloaded. Therefore when you type a URL it is quite legitimate to receive different IP addresses on different occasions, with only open SSL sessions retaining IP persistence.

The window of opportunity to exploit this issue with the DNS has mostly passed already. All vendors have now issued patches for their software (including, finally, Apple, who were the last major vendor to do so), and due to the severity of the issue patching DNS servers was given major priority.

The sky is not on this occasion falling.

 

[robertjordanusa]

I just read and heard differently

I have heard and read that the patches applied are only temporary fixes at best until another exploit occurs. It would seem that direct IP addressing is the only certain way to reach your destination with utter assurance. Thus, I am merely trying to setup some bookmarks for the most important sites I visit such as banks and credit cards with direct IP addresses.

So am I to understand that there is no way to directly access pages within a website (ex. https://chaseonline.chase.com/Logon.aspx) using an IP address (xx.xx.xx.xxx. ~whatever) using the locations toolbar even though this is the most secure way to get anywhere. Anything else leaves me with a sense of vulnerability and subservience to hackable DNS servers.

 

[TEG]

I have heard and read that the patches applied are only temporary fixes at best until another exploit occurs. It would seem that direct IP addressing is the only certain way to reach your destination with utter assurance. Thus, I am merely trying to setup some bookmarks for the most important sites I visit such as banks and credit cards with direct IP addresses.

So am I to understand that there is no way to directly access pages within a website (ex. https://chaseonline.chase.com/Logon.aspx) using an IP address (xx.xx.xx.xxx. ~whatever) using the locations toolbar even though this is the most secure way to get anywhere. Anything else leaves me with a sense of vulnerability and subservience to hackable DNS servers.

To access a website, the address, either a DNS entry (ie macrumors.com) or an IP address (ie 168.212.140.114) must be prepended with the protocall used. Be that http://, https://, or ftp://, these are required to connect to the correct section of the server you are connecting to.

The DNS "Exploit" just makes your browser think that it is at macrumors.com when it is infact on a different server. The nice thing about https:// is that if the IP address on the sites certificate (stored offsite) and the IP address that you are connected to are different, then you will be informed by the browser, and the lock icon will not appear in the window.

Also, you are confusing URL with a DNS address. The URL can either be an IP address and path or DNS address and Path.

TEG

 

[alphaod]

Just use Firefox or Opera.