Spoof

This spoof works with Mozilla Firefox version 0.9, 0.9.1, 0.9.2, and the "nightlies" through at least 20040730. This particular demo does not work in the Mozilla Browser, but I know of no reason one could not be created.

For this spoof to have maximal effect, you must have the following settings at their default, out-of-the-box state:
View the spoof that mimics the interface of Firefox versions 0.9.0 - 0.9.2
View the spoof that mimics later versions of the interface of Firefox (nightly builds)
[update 2x] Apparently this only works on on some MacOS X boxes. [thanks ed, Markus]... please give me feedback on what it does and doesn't work on. Tell me your operating system, exact Firefox build number (Help | About , down at the bottom), and what doesn't work.

You can try the following things

Discussion/Links

For some good discussion on the issue, see these links:

Limitations

Yes, the fake toolbar buttons don't do anything when clicked. Yes, the menu items are all dead. But they don't have to be. A diligent bad guy could produce enough modified XULs to emulate nearly the entire browser. If the padlock icon can be made to work, anything can work.
So what is safe from tampering? A bad guy can't read your browser preferences. He doesn't know whether you use large toolbar icons or small ones, what your bookmarks are, or what sort of extensions you have installed.

Timeline

Why 5 Years?

I keep getting this question in my email, so I'll try and provide my response here. Please note that this is my personal, uninformed, not-officially-affiliated-with-the-Mozilla-Foundation, unfactual opinion.
The original bug was filed 5 years ago. The year 1999 was a completely different internet than we have now. Back then, the Mozilla folks were just trying to get a functioning browser out the door. However, the only people who actually used it were nerds and geeks. These tech-savvy users didn't often fall for paypal, ebay, and banking scams. Back in 1999, there really weren't any scams like that. "Phishing" was not in anybody's dictionary.
So with a world like that, a bug that said "theoretically, somebody could make a window that looks like something it isn't" didn't scare many people. The developers had better things to work on, like making the browser work.
The bug was filed, and duly examined. Some suggestions were made, some patches were produced, but in the end, it all seemed kinda silly. People more or less forgot about the bug.
Now, I'm not a Mozilla developer, so I don't know a whole lot about their bug-tracking system. But somehow, they don't seem to do a lot to re-examine old bugs and resolve them. There are a lot of things floating around in their bug database that seem to be permanently unresolved.
Well, flash forward to the year 2004. Spoofing attacks like this are suddenly common, and Real People are finding themselves sans identity, or $2000. In my opinion, this is a result of three factors: the average internet-user is getting less and less computer-savvy, more people are using the internet for vital financial matters (like online banking, credit cards, stock trading, paypal, and shopping), and a certain large vendor's mishandling of the web browser market has resulted in a dangerously-insecure monoculture.
So, do I think that the Mozilla Foundation went and actively suppressed a bug like this? No. Do I think that they take security seriously? Yes. Do I think that they screwed up? Maybe a little. Do I think that they should modify their development process to eliminate oversights like this? Maybe a little.

I hope that answered some of your questions.

--Jeff

ps, Although you can't see it here, the XUL files are being preloaded at this page, so they pop up almost instantly when you activate them. Since I'm no Javascript guru, I used a clunky splunge to force them to be preloaded; that's why there are a few javascript errors listed in the console.

Page last updated on 8-2-2004. I do not provide any guarantee that this page will be here in a year, so please don't link to it with expectation of permanency.