Microsoft has outlined plans to make phishing attacks more difficult by dropping support for a common Web authentication method.

Redmond's plans to remove support for handling user names and passwords in HTTP or HTTPS URLs in IE are designed to protect Web surfers from being lured to malicious constructed or fraudulent sites.

The problem is compounded by an unpatched security vulnerability which could be exploited to display a fake URL in the address and status bars of IE.

Rather than fix that specific flaw, which first emerged almost two months ago, Microsoft is ditching an entire approach. This is a radical step that will cause considerable inconvenience to the minority whilst frustrating one particular technique for making password harvesting scams appear more plausible.

Microsoft is giving advanced notice of the changes to allow Web designers a chance to review Web site code.

Following the update, the following URL syntax username:password@server/resource.ext will no longer be supported in IE or Windows Explorer.

Microsoft's advisory explains the issue in greater depth and outlines possible workarounds for Web developers. ®