Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google adds experimental setting to hide full URLs in Chrome 85 address bar

androidpolice.com

Post reply on HN
Print view View original

201–210 of 733 posts

Re: Google adds experimental setting to hide full URLs in Chrome 85 address bar

#201

Post by extra88 »

vladvasiliu wrote: post #147
gspr wrote: post #64

Earlier quoted context omitted.

Next step: an "education campaign" to tell people that that part of the web is "insecure". In fact you should only get any content from a handful of domains. And in non-net-neutrality jurisdictions, the ISPs will start offering packages that work with pre-approved domains only. And since it'll be enough for 90% people, it'll work. I hope I'm just being alarmist.

This already kind of happens in Firefox. If you have a non public certificate authority, when you visit a site signed by that CA it says that it's not verified by an authority known to Firefox. I don't know if there is a way to "bless" such an authority once it's added to the trust store.

What browser doesn’t warn you about sites signed by a CA not in their list of CAs?

Re: Google adds experimental setting to hide full URLs in Chrome 85 address bar

#202

Post by CyanBird »

toyg wrote: post #177
curiousgal wrote: post #76

Earlier quoted context omitted.

You can easily transfer those to Firefox. That being said, I admit that staright out of the box Firefox doesn't have the same experience but you can customize every little thing about it to make it suit your needs.

That’s too close for comfort to the Windows/Linux comparison. This said, I honestly don’t understand what people mean when they say the experience is “superior” in Chrome. It’s a web browser. It browses. You get passwords saved and synchronised. Everything else is an extension. What’s so bad about FF...?

I would love to get comments from Chrome users

I just could not live without firefox and being unable to share tabs/links from anywhere in my phone to my desktop and or laptop

Re: Google adds experimental setting to hide full URLs in Chrome 85 address bar

#203

Post by ben_w »

psexec wrote: post #157
ben_w wrote: post #102

Earlier quoted context omitted.

Insightful, but I am confused by the final paragraph: > I'm tired of this anti-Web and anti-accessibility SJW nonsense “SJW” must have a meaning I’m not familiar with, because Social Justice Warriors would be pro-accessibility, not anti.

How about this idiocy? https://9to5google.com/2020/06/12/google-android-chrome-blac...

That’s not an example of idiocy.

Idiocy would be an anecdote my father told me in the mid-90s about his workplace trying to implement the same spirit with a naïve global search-and-replace, leading very quickly to a company-wide invitation to an “African-American tie dinner”.

But even that isn’t anti-accessibility.

Re: Google adds experimental setting to hide full URLs in Chrome 85 address bar

#204

Post by swyx »

jpxw wrote: post #20

I can see the arguments for why this might be advantageous security-wise. I just hope they make it easy to disable (and it remains possible to disable in future) for those of us who are technically minded and are able to read URLs.

what security arguments are there that are not also solved by highlighting the domain instead of removing critical information?

Re: Google adds experimental setting to hide full URLs in Chrome 85 address bar

#206

Post by surfpel »

Tehnix wrote: post #5

So Chrome is only showing the domain part now? Just like Safari has been for a long time? Personally I quite like it. From what I understand the main goal is to make phishing attacks more clear to the user, since this is ultimately only a thing the end-user can protect against. Removing the noise definitely helps for that. Having had it like this in Safari for a long time, I must say I greatly prefer this over the ol…

I agree. I spent a few minutes confused as to what everyone was so mad about. Surprised this is an issue for anyone.

Unless you need to modify the URL often, but it has the hover behavior and if even safari has an option for it, I can't see google removing that option.

Re: Google adds experimental setting to hide full URLs in Chrome 85 address bar

#207

Post by noisem4ker »

psexec wrote: post #157
ben_w wrote: post #102

Earlier quoted context omitted.

Insightful, but I am confused by the final paragraph: > I'm tired of this anti-Web and anti-accessibility SJW nonsense “SJW” must have a meaning I’m not familiar with, because Social Justice Warriors would be pro-accessibility, not anti.

How about this idiocy? https://9to5google.com/2020/06/12/google-android-chrome-blac...

I'm not against the effort just because "block-list" and "allow-list" are more speaking and self-evident in their meaning. Insinuating that "black-list" and "white-list" are somehow racially charged terms is the idiotic part.

Re: Google adds experimental setting to hide full URLs in Chrome 85 address bar

#208

Post by megous »

ubercow13 wrote: post #145
mkl wrote: post #26

Earlier quoted context omitted.

Do you know if this information is somewhere more accessible than a 20 minute video? Hiding the https and www is already frustrating enough, and this change would make Chrome barely usable for my purposes.

The claimed purpose is basically just to prevent phishing. They explain a number of reasons why it is difficult for people to extract from a URL the part which is relevant to security, ie. the bit that affects who has authority over the page and how your cookies will be separated by the browser. The cookie sharing actually had some rules I didn't know about as a non-web developer but experienced URL user. They show h…

Looks like this will be great for reflected XSS attacks. Even advanced users will not be able to notice there's something weird going on outside of the domain name part of the URL. Perfect!

Basically any page on the website with this vulnerability will be useable to show a fake login page, and user will not even notice he's not on the /login, but on some weird path + ?_sort=somejavascript

Not that it's that hard to clean up url via history api after you get access to the page via XSS atm, but there's still some short period of time where the full url is shown in such a case, that may provoke suspicion.

Re: Google adds experimental setting to hide full URLs in Chrome 85 address bar

#209

Post by noisy_boy »

I moved back to Firefox last year and haven't had any reason to switch back to Chrome. FF has been plenty performant and even if was few microseconds slower than Chrome, I will still stick with it because it's in our collective interest to keep the competition alive. This ridiculous decision by Google just made my resolve stronger.

Re: Google adds experimental setting to hide full URLs in Chrome 85 address bar

#210

Post by skissane »

The other day, our 7 year old told me that [ is 5B and ] is 5D. I was quite impressed that he knew this, and I asked him how he knew it. He told me it was from reading the address bar in Roblox. Needlessly hiding technical details from kids is going to limit their learning.
Post reply on HN