View source for Network.http.phishy-userpass-length

==Background==
A popular method of disguising a website&#8217;s true location is to make use of the username/password syntax in URLs. Normally, when sites require authentication, users can specify the username and password directly in the URL thusly:

 http://username:password@example.com/

(This is the same syntax that [[FTP Authentication|FTP URLs]] use.) However, this syntax can be abused to make it appear as though the URL is that of another host:

 http://www.mozilla.org&login3:141592653589793238462643383279502884197169@example.com/evil

In response to this possibility, Microsoft [http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;834489 removed the syntax from IE]. Mozilla&#8217;s response was to use a dialog to warn the user when visiting URLs that use the username and password syntax (but not when manually entering them). This preference lets you determine what is considered &#8220;phishy&#8221; enough to warrant displaying the dialog.