711–720 of 919 posts
Earlier quoted context omitted.
How about displaying an identicon, that is rendered from the domain, in the address bar? People might soon learn what the icons of their important sites look like and will easily detect if somebody is trying to phish their bank account.
FWIW, OpenSSH already does this and calls it "randomart".
Earlier quoted context omitted.
I think the comparison to spark plugs is misleading when we talk about URLs and security. It's more like looking in the mirror before changing lanes. It's something you need to check in order to stay safe. Mirrors, like URLs, are just an implementation detail. But since currently driving works with mirrors, you have to learn how to use them.
I think the spark plugs example is an excellent one. People used to require an extensive knowledge of how cars worked in order to have a prayer of using them effectively. Now they don't, because we realized none of that knowledge is necessary if you design the system correctly. We have enough historical context to realize that things like parsing URLs by eye is unsafe for the general population, and always will be. T…
Earlier quoted context omitted.
Sorry, what? Could you expand on this? What do you mean by doing away with URLs?
From the linked article: "I don’t know what this will look like, because it’s an active discussion in the team right now," says Parisa Tabriz, director of engineering at Chrome. "But I do know that whatever we propose is going to be controversial. That’s one of the challenges with a really old and open and sprawling platform. Change will be controversial whatever form it takes. But it’s important we do something, bec…
Hidding the url scheme was the first step down this path of utter stupidity and I vividly remember the hostility and hubris of the Chrome team at the time.
We still have Firefox, but many times they just blindly follow suit.
Earlier quoted context omitted.
This one is kind of a "religious" topic for me, I guess. I'm sorry that it is, but it makes me exceedingly defensive. I trained on Active Directory (AD) with a group of veteran sysadmins in 1999. I don't have access to the "Microsoft Official Curriculum" book from my class in '99 (long-since thrown away), but I have a distinct memory of a lively conversation in class re: the pitfalls of using a public domain name as…
I don’t know anything about AD, so this might be a stupid question: can you not just run a web server on the same host as the AD server or port forward all HTTP traffic to a different server?
And the other comment mentioned that this was a known issue 20 years ago because the old versions of IIS did not support redirecting.
This and many other changes over a course of a short period of time have caused me to go to Firefox exclusively now. I heard Firefox is going to stop third party cookie tracking altogether. Why not give Google the big finger and use a different browser? Vote with your cold hard actions if you feel so strongly about something.
Earlier quoted context omitted.
This is certainly subverting the domain name system. I can't see the value or gain in security by this. (If you want to put focus on the domain, then display the host-part with less contrast, i.e. grey, but don't hide any potentially vital information. Otherwise, put out a RFC, defining "www" as a substitute for "*", or a zero-value atom, in order to guarantee consistent behavior.) Edit: There are also legal concerns…
A proposal for better security with domain names: The domain name system has been around for decades and it's a clever and proven system. It can – and should be – taught in school and, arguably, knowledge of it is, while not difficult to obtain, essential in our times. Additional ambiguity in this is probably not what we want. Arguably, the most sincere problems arise from mixed alphabets with Unicode domains and loo…
Earlier quoted context omitted.
This is certainly subverting the domain name system. I can't see the value or gain in security by this. (If you want to put focus on the domain, then display the host-part with less contrast, i.e. grey, but don't hide any potentially vital information. Otherwise, put out a RFC, defining "www" as a substitute for "*", or a zero-value atom, in order to guarantee consistent behavior.) Edit: There are also legal concerns…
> There are also legal concerns with catch-all domains in some countries. Wow, really? Could you expand a little? I tried to search but all I got was catch-all mail addresses and no legal issues. Thanks!
What it was about: Say, there was a review or best-price-search site (here, "service.at"), using catch-all and mapping subdomain requests to product searches. So "acme.service.at" would be remapped to, say, "service.at/search?q=acme". Now Acme sued, claiming anything containing the name "acme" on the web ought to point to their site, including the subdomain "acme.search.at", since they were the owner of the name "Acme". To almost everybody's surprise the court decided that this was true, according to naming rights, and that a subdomain containing this name, even if just implemented virtually by a catch-all mechanism, was an infringement. This also implies that "acme.example.at", which is included in the set of "*.example.at", mapped to the very same as just "example.at" is a possible infringement. – Strange, but this is as it is. And, yes, it's particularly about search engines, like Google.
(I really don't remember the particulars, since this has been some years ago by now, but we may assume that the results returned by the service weren't exactly favorable and that the particular search enjoyed a higher Page rank than the site of this vendor, or at least a rank, which brought it up near the site of the vendor in search results.)
Earlier quoted context omitted.
this is actually the main reason I cannot use Safari. It always boggled my mind that they made this decision. For power users, they never look at the url unless they want information from it, in which case the `www` is valuable. For low tech users, it can lead to straight up incomprehensible issues, like sites not rendering properly (think of a `m.*`). The UI gains are so small, that part of the screen is never reall…
Low-tech users don’t often understand that a difference could possibly exist between “m.” and “www.” at all. However, if it shows the TLD, they can confirm it says “google.com”. Imagine they’re visiting a Paypal phishing link, to the domain: www.paypal.com.www.com The most important thing to show the user is “www.com”, because they’re expecting “paypal.com”. All the rest is nonessential for protecting users from bad…
I'm ok with hiding "www.", but it also hides "m." which is sometimes very confusing (I once opened a m.facebook.com link and was very puzzled why it uses the mobile site when the URl bar just shows "facebook.com").
What you may be surprised to learn is that Chrome isn't just stripping "www." from the beginning of the subdomain. "subdomain.www.domain.com" displays as "subdomain.domain.com"