To be sure, there are remedies for the flaw. Instead of sending visitors directly to pages linked from theirs, Web site operators can automatically send users to an in-house dummy page that would then direct users to the desired destination on the Net. Developers at Microsoft and Netscape initially blamed an industry standard for their GET woes. Thus, company executives claimed, the problem lies in the specification, not their browsers. Security experts scoffed at their contention, however.
Web designer sets up a page to take credit card and other consumer information.
Designer uses a command called GET to capture the information online. While some server software captures and places credit card information into another file, GET attaches the data to the end of the Internet address the visitor typed to get to the site. Visitor decides to navigate the site and types in a new URL from the address line. In some instances, the next site asks the user's browser where the user was last. All information, which is presumably encrypted before it is sent out on the Internet, lands at the next server, which may or may not be protected against unauthorized visitors.