Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 69: “www.” subdomain missing from URL

bugs.chromium.org

Post reply on HN
Print view View original

581–590 of 919 posts

Re: Chrome 69: “www.” subdomain missing from URL

#581

Post by magicalist »

Donzo wrote: post #574
magicalist wrote: post #564

Earlier quoted context omitted.

> they are slowly trying to do away with URLs They might be changing how they want to display them, but "do away with" is unsupported by the article: > But this will mean big changes in how and when Chrome displays URLs. We want to challenge how URLs should be displayed and question it as we’re figuring out the right way to convey identity. https://www.wired.com/story/google-wants-to-kill-the-url/

Did you read the whole article? "The focus right now, they say, is on identifying all the ways people use URLs to try to find an alternative that will enhance security and identity integrity on the web while also adding convenience for everyday tasks like sharing links on mobile devices." My statement is clearly supported by the article. They paint a rosy picture of it, because this is a submarine piece, but they are…

> My statement is clearly supported by the article.

You're ignoring a direct quote in favor of a Wired reporter paraphrase (one which mentions sharing links, no less). They cite an earlier effort, which was a display change. This issue is for a display change. None of this points to "trying to do away with URLs".

Re: Chrome 69: “www.” subdomain missing from URL

#582

Post by mrec »

masswerk wrote: post #575
pvorb wrote: post #555

Earlier quoted context omitted.

How about displaying an identicon, that is rendered from the domain, in the address bar? People might soon learn what the icons of their important sites look like and will easily detect if somebody is trying to phish their bank account.

We might even call it "favicon", for the fun of it… :-)

Not sure if serious, but no. Anyone can copy a favicon; the point of an identicon is that it's generated from the domain name, so subverting it would require an attacker to find a hash collision with a visually similar domain.

Re: Chrome 69: “www.” subdomain missing from URL

#583

Post by waterhouse »

pvorb wrote: post #555
masswerk wrote: post #294

Earlier quoted context omitted.

A proposal for better security with domain names: The domain name system has been around for decades and it's a clever and proven system. It can – and should be – taught in school and, arguably, knowledge of it is, while not difficult to obtain, essential in our times. Additional ambiguity in this is probably not what we want. Arguably, the most sincere problems arise from mixed alphabets with Unicode domains and loo…

How about displaying an identicon, that is rendered from the domain, in the address bar? People might soon learn what the icons of their important sites look like and will easily detect if somebody is trying to phish their bank account.

The space of easily visually distinguishable images has a certain size. Let's assume there's a deterministic, pseudorandom mapping from domains to images. For a given domain, how many plausible impostor domains are there? What's the chance that there's at least one impostor domain that happens to get the same image?

If you have 1000 distinct images, but a given domain has 5 letters that could each be replaced with any of 3 visually identical Unicode characters, then, well, the chances are very high that there exists a plausible impostor domain with the same image. I don't think this is a very workable approach.

Re: Chrome 69: “www.” subdomain missing from URL

#585

Post by lalaithion »

UncleMeat wrote: post #430
masswerk wrote: post #294

Earlier quoted context omitted.

A proposal for better security with domain names: The domain name system has been around for decades and it's a clever and proven system. It can – and should be – taught in school and, arguably, knowledge of it is, while not difficult to obtain, essential in our times. Additional ambiguity in this is probably not what we want. Arguably, the most sincere problems arise from mixed alphabets with Unicode domains and loo…

> Arguably, the most sincere problems arise from mixed alphabets with Unicode domains and look-alike characters/glyphs. No way. The most sincere problem is that hostnames do not enforce any binding to a real world identity that users can understand (nobody inspects certs) and that the most trustworthy component of a hostname is the second to the last section (right before ".com"). Humans tend to look at the front of…

The best security change we could make, imo, is rewriting domains so that they look like com.evil.bank.www/now/urls/go/from/most/specific/to/least

Re: Chrome 69: “www.” subdomain missing from URL

#586

Post by vbezhenar »

jrowley wrote: post #405
mehrdadn wrote: post #392

Earlier quoted context omitted.

Sorry, what? Could you expand on this? What do you mean by doing away with URLs?

Many users never use the url bar. They just 'Google' for websites they want to access and follow the results.

I'm occasionally doing that and especially suggest non-technical users to do exactly this thing. I can mistype URL. Google will correct me, if site is well-known. Otherwise I'm risking to go to phishing website.

Re: Chrome 69: “www.” subdomain missing from URL

#588

Post by jsjohnst »

slenk wrote: post #396
abalone wrote: post #393

> This is a dumb change. No part of a domain should be considered "trivial". As an ISP, we often have to go to great lengths to teach users that "www.domain.com" and "domain.com" are two different domains... What ISPs teach their users anymore these days? Why the heck do we want to go back to that? Time for a modicum of historical perspective. If you care about usability this is clearly an improvement. This is part o…

Two prominent examples noted in the bug: https://citibank.com.sg and https://www.citibank.com.sg are different, http://www.pool.ntp.org and http://pool.ntp.org are different. Like, big companies run separate servers on the two domains. That's besides the fact where if you have www.example.www.example.com, it rewrites to example.example.com.

Also noted in the bug:

m.tumblr.com IS NOT a mobile variant of tumblr.com

I kinda wished I had that blog now so I could put a proof of concept up to show why this is a very bad idea from a phishing perspective.

Re: Chrome 69: “www.” subdomain missing from URL

#589

Post by berti »

sofaofthedamned wrote: post #497
parliament32 wrote: post #118

Considering a subdomain "trivial" is ridiculous... there's a difference between "www.example.com" and "example.com". Not only can they serve different sites, they can even have different DNS records! It seems that "m." is also considered a trivial subdomain. So when a user clicks a link to a "m.facebook.com" uri, they'll be confused why FB looks different when the browser reports it's on "facebook.com". I sincerely h…

Oh come on. "www." was used as a way of delineating what was a web address. Hence the fashion of putting that there so people knew you had to do it in the browser. Before then people used to also put the " http://" on there, and the combination of the two on vehicles/signs was ridiculous. We're now in a web world. People know what a URL is. "domain.com" isn't ambiguous, it's obvious to man, beast or child that you ty…

Message 3[1] in the linked discussion has a great counter-example: "How will you distinguish http://www.pool.ntp.org vs http://pool.ntp.org ?

One takes you to the website about the project, the other goes to a random ntp server."

I do totally agree about m., but it's not Google's place to dictate that, rather it's a decision for each entity to make for themselves.

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=881410...

Re: Chrome 69: “www.” subdomain missing from URL

#590

Post by jsjohnst »

abalone wrote: post #539
hrez wrote: post #434

Earlier quoted context omitted.

user1 - https://citibank.com.sg doesn't work for me user2 - it's fine, here is a screenshot of it working (while showing "beautified" https://www.citibank.com.sg ) how is that not confusing?

If this is the worst example anyone can come up with, debugging a misconfigured site while relying exclusively on screenshots of beautified URLs, then I think it proves my point. There will always be tradeoffs in advancing usability. This is objectively a small one. The problem is the unstated lack of appreciation for the value of usability improvements, because it's usually a more technically sophisticated person cr…

Here’s a better example: https://news.ycombinator.com/item?id=17930788
Post reply on HN