Version: (using KDE KDE 3.1.3) Installed from: SuSE RPMs Many email-based scams rely on tricking users by embedding the expected web server hostbname in the password field of the extended URL syntax, like so: mysite.co.nz:actually@anothersite.com/location/page.html Legitimate URLs that embed usernames and passwords are reasonably rare. When a user follows a URL from any KDE application that contains a username and password, KDE should pop up a dialog box and clearly state the hostname it intends to connect to and the username/password it will be using, asking for confirmation. This will help to mitigate such attacks. If necessary, it could be a preference to pop up a dialog box. Sorry if I have used the wrong bug reporting category; I had difficulty finding the approporiate category.
This sounds like a pretty good idea actually. There are other ways to deal with this kind of "scammy URL" though, I'm not sure what's the best.