For one thing, I blocked that foolish kid who tweeted that browsers should warn about "googie.com" (a term that refers to a style of architecture https://en.wikipedia.org/wiki/Googie_architecture ). Knee jerk response make things worse.
Humans Are Bad at URLs and Fonts Don’t Matter
61–70 of 109 posts
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#62A password manager helps simply because it "remembers" exactly what sites you've been to in the past and if you go to a different site with a same looking url it won't auto-fill. Well, your browser also has a history of all the sites you've been to in the past, and people tend not to go to a lot of random sites. It would be pretty simple to display something when you go to a site you've never been to before. Just an…
> Well, your browser also has a history of all the sites you've been to in the past, and people tend not to go to a lot of random sites. It would be pretty simple to display something when you go to a site you've never been to before. Just an unobtrusive, but not too unobtrusive, "this is your first visit to this site.". Whoa, that seems like a shockingly good idea! It could look similar to what happens when you ente…
Hell, that warning could be helpful even on signups to new sites: “This is your first time visiting this website. Only enter passwords on websites you trust, and don’t reuse passwords from other sites. We recommend you use this securely-generated password:”
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#63Earlier quoted context omitted.
Must speech be anonymous to be free?
Yes. That’s why voter anonymity is so important, for example.
I would posit that for normal run-of-the-mill communications, anonymity is overrated. What is this edge case of politically sensitive communications that you think is at risk?
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#64Any opinions on re-configuring / modifying workflows "in-flight". and configuration in general. While using JIRA as a developer is generally pleasant when workflows are well configured, configuration of JIRA as a team manager is an absolute pig.
And if you look at configurations from API perspective, you understand that JIRA is full of fuck (and their api is a veeeery leaky abstraction)
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#65> t.co/Ati2ndKvGI
Case sensitive identifiers should have been never allowed.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#66Earlier quoted context omitted.
> Well, your browser also has a history of all the sites you've been to in the past, and people tend not to go to a lot of random sites. It would be pretty simple to display something when you go to a site you've never been to before. Just an unobtrusive, but not too unobtrusive, "this is your first visit to this site.". Whoa, that seems like a shockingly good idea! It could look similar to what happens when you ente…
Hell, that warning could be helpful even on signups to new sites: “This is your first time visiting this website. Only enter passwords on websites you trust, and don’t reuse passwords from other sites. We recommend you use this securely-generated password:”
Idk, I’d get a little nervous extending it too much. Browsers and sites have far too many use-our-new-feature-plz popups. This shouldn’t look like that, or it’s more likely to be ignored.
I might keep your first addition but nix the final paragraph, as good a suggestion as it may be.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#67Why must there be exactly one solution that solves everything? We don't expect that anywhere else in life.
Obviously it's best if there was a simple automated solution that worked in all cases, but there is no such thing. Password managers are great, but they don't counter disinformation from sites you don't have a password with. Preventing access to malicious sites only works if it's known to be malicious; new sites will always slip through (and attackers can keep creating new sites), false positives are a problem, and not everyone can afford them. Reputation systems can be gamed.
In many cases you try to make it so that an attacker has to pass multiple barriers, instead of pinning your hopes on a single perfect solution. Usually there isn't one.
So yes, DO display the URL; use fonts, lowercased domains, colorize each character by Unicode region, or whatever you have to do to help users detect when there could be a problem. Then let users check. Some URLs will slip through, but I'll note that a LOT of people picked up the "googIe.com" in the survey - it wasn't randomly distributed.
DO use a password manager. That will dramatically help if you've previously logged into that site.
I'm less excited about filtering domains, especially because some implementations are privacy disasters. But if done in a privacy-respecting way, I can see some value. But only SOME value - they are NOT a panacea. And many will not use them.
The goal isn't to find the one true answer; the goal is to make it unlikely for an exploit attempt to work. If you CAN come up with a perfect automated defense that's affordable, great, do that. In most circumstances you need multiple defensive mechanisms so that the attacker has to overcome multiple very different barriers.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#68While this is a legitimate problem, the article seems to be a disguised advertisement for NordVPN and 1Password, who Troy Hunt is partnered with [1] [2]. There is a clear bias towards suggesting that the solution to the problem is that everyone signs up and pays for these services. [1] https://www.troyhunt.com/im-partnering-with-nord-as-a-strate... [2] https://www.troyhunt.com/have-i-been-pwned-is-now-partnering...
Honestly, it wasn’t much of a disguise. Not subtle.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#69Earlier quoted context omitted.
I'm honestly surprised at Firefox's behavior here. I thought all of the browsers years ago identified homoglyph attacks and deployed defenses. For example, in Safari, this domain does render as https://www.xn--80ak6aa92e.com because Safari decided this was a homoglyph attack. My impression was all the browsers did this for any domain that used a homoglyph of a latin character, so why is Firefox failing?
As far as I can recall, Firefox (and maybe Chrome) will still display the original glyphs if they are all from the same character set. So for example, all Cyrillic apple will display as apple, but apple where only the a is Cyrillic will display punycode for the a.
Edge does display punycode, but not sure if it's an Edge thing or a Chromium (and therefore Chrome) thing.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#70Earlier quoted context omitted.
Yes. That’s why voter anonymity is so important, for example.
I would posit that for normal run-of-the-mill communications, anonymity is overrated. What is this edge case of politically sensitive communications that you think is at risk?
I lose my job for supporting the wrong candidate?