Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Humans Are Bad at URLs and Fonts Don’t Matter

troyhunt.com

Post reply on HN
Print view View original

101–109 of 109 posts

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#101

Post by pvorb »

dwheeler wrote: post #100
pvorb wrote: post #79

Earlier quoted context omitted.

A few years ago, I had this idea of using identicons to visualize the host part of URLs: https://vorba.ch/2018/url-security-identicons.html I still think this could help people realize when they are being phished at least for their most important sites in a privacy-respecting way, even if they don't use a password manager for those sites. I don't use my password manager for my banking account, for instance, since I d…

Attackers will then work to find domain names that generate similar identicons. But maybe the identicons don't need to be meaningful or the same for everyone. You could hash the domain with another value, like a computer name or username, then show some interesting pattern. Then it would have a different pattern. Not perfect, but yet another user cue.

Yes, agreed. This could only be one of many factors.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#102

Post by nneonneo »

Wowfunhappy wrote: post #66
nneonneo wrote: post #62

Earlier quoted context omitted.

Hell, that warning could be helpful even on signups to new sites: “This is your first time visiting this website. Only enter passwords on websites you trust, and don’t reuse passwords from other sites. We recommend you use this securely-generated password:”

Idk, I’d get a little nervous extending it too much. Browsers and sites have far too many use-our-new-feature-plz popups. This shouldn’t look like that, or it’s more likely to be ignored. I might keep your first addition but nix the final paragraph, as good a suggestion as it may be.

To be fair, my browser (Firefox) already suggests a secure random password on password dialogs for sign-ups; I believe they are either using the heuristic of "no password saved on the site" or "password confirmation box exists". I was more-or-less simply thinking of extending that particular message.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#103

Post by ZoomZoomZoom »

invokestatic wrote: post #92
ZoomZoomZoom wrote: post #83

I always wondered why don't browsers highlight the address bar with the color sourced from the domain hash? If my bank's site is always pink but after clicking a link it's suddenly teal, could it get any easier? When https green shields and locks appeared at first I thought it's something like that, only to be disappointed.

I don’t think there are enough unique human distinguishable colors to make this worthwhile. I imagine it wouldn’t be too hard to find a “collision”.

C'mon, just add a simple shape or an emoji to the color or something, besides, it has to be a collision AND a visually similar domain.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#104

Post by sebastian_j »

montebicyclelo wrote: post #42

While this is a legitimate problem, the article seems to be a disguised advertisement for NordVPN and 1Password, who Troy Hunt is partnered with [1] [2]. There is a clear bias towards suggesting that the solution to the problem is that everyone signs up and pays for these services. [1] https://www.troyhunt.com/im-partnering-with-nord-as-a-strate... [2] https://www.troyhunt.com/have-i-been-pwned-is-now-partnering...

I don't blame the guy trying to earn some extra money for the work he puts in. You can't expect him to spend time creating useful content and getting nothing out of it. The products are relevant, so I don't see a problem.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#106

Post by basicexploit »

ljm wrote: post #87
montebicyclelo wrote: post #42

While this is a legitimate problem, the article seems to be a disguised advertisement for NordVPN and 1Password, who Troy Hunt is partnered with [1] [2]. There is a clear bias towards suggesting that the solution to the problem is that everyone signs up and pays for these services. [1] https://www.troyhunt.com/im-partnering-with-nord-as-a-strate... [2] https://www.troyhunt.com/have-i-been-pwned-is-now-partnering...

He loses my respect with that. NordVPN isn't without its problems and he's also selling a VPN that monitors your browsing to detect this stuff. A VPN that grows by underselling itself all over youtube isn't one I want to be a customer of. If he wants to use his rep to write fluff pieces for his corporate sponsor, so be it. But he discredits himself for doing so.

I dont want to be devil's advocate as a quote says, but I see Troy Hunt implication in Nordvpn as a huge step. His authority and reputation are very good so I believe his straightforward will keep improvements ongoing. I still think being inside of the industry remains the best way to improve it.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#107

Post by trustfailure »

ljm wrote: post #87
montebicyclelo wrote: post #42

While this is a legitimate problem, the article seems to be a disguised advertisement for NordVPN and 1Password, who Troy Hunt is partnered with [1] [2]. There is a clear bias towards suggesting that the solution to the problem is that everyone signs up and pays for these services. [1] https://www.troyhunt.com/im-partnering-with-nord-as-a-strate... [2] https://www.troyhunt.com/have-i-been-pwned-is-now-partnering...

He loses my respect with that. NordVPN isn't without its problems and he's also selling a VPN that monitors your browsing to detect this stuff. A VPN that grows by underselling itself all over youtube isn't one I want to be a customer of. If he wants to use his rep to write fluff pieces for his corporate sponsor, so be it. But he discredits himself for doing so.

You can't blame a company for doing its business and wanting to grow mate. It's part of company evolution, as soon as the produit is built, you can promote it, thats one way to earn money. It's just the growing cycle. And look at how competitive this industry is.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#108

Post by troublesom »

basicexploit wrote: post #106
ljm wrote: post #87

Earlier quoted context omitted.

He loses my respect with that. NordVPN isn't without its problems and he's also selling a VPN that monitors your browsing to detect this stuff. A VPN that grows by underselling itself all over youtube isn't one I want to be a customer of. If he wants to use his rep to write fluff pieces for his corporate sponsor, so be it. But he discredits himself for doing so.

I dont want to be devil's advocate as a quote says, but I see Troy Hunt implication in Nordvpn as a huge step. His authority and reputation are very good so I believe his straightforward will keep improvements ongoing. I still think being inside of the industry remains the best way to improve it.

I like to read all sorts of opinions and I will be in your side this time. I do understand the disappointment of some but I am convinced this is for the best. Many initiatives have been taken since the beginning, as well as efforts. For example the Trust Initiative or the bug bounty. One way or another, they have a positive impact on the whole VPN industry although there is some room for improvements.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#109

Post by yencabulator »

This sounds like a great example for why domain name writing order should be hierarchical. Consider:

com.google.accounts/612361/signin/v2/identifier?hl=en&... com.tinyurl.amp.com.google.accounts/612361/signin/v2/identifier?hl=en&...

(And these days, since google have the .google TLD, they don't even need that "com.")

Post reply on HN