Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's experiment of hiding the URL is great for security

jakearchibald.com

Post reply on HN
Print view View original

21–30 of 211 posts

Re: Chrome's experiment of hiding the URL is great for security

#21

Post by bambax »

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

> phishing is a very big problem

Is it? What are the numbers?

So many annoying things are done in the name of "security" without much justification (both online and in real life); Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help folks who can't be bothered to read it?

Another comment suggests "source code highlighting" for the url, where the actual domain would be emphasized while still showing the whole url: what are your thoughts on this?

(Disclaimer: I have not tried the Chrome version in question so I very well may not know what I'm complaining about.)

Re: Chrome's experiment of hiding the URL is great for security

#22

Post by personZ »

kylemaxwell wrote: post #14
personZ wrote: post #12

Surprised to see so much attention to this: Isn't it exactly what Safari on iOS does on hundreds of millions of devices worldwide? EDIT: And given the seeming confusion by some, no, the "article" (if a couple of screenshots and some guy giving an opinion is an "article") is utterly irrelevant to this comment. Noting that it mentions iOS is meaningless. We continually see front-pagers voted up by people who seem bliss…

Did you even read the article, where that comparison is made explicit?

No, I didn't read the article, nor did I claim or indicate that I did in any way. Yet here is yet another front pager about Chrome experimenting with something that Safari on iOS has done for some time, as if people just discovered fire.

Re: Chrome's experiment of hiding the URL is great for security

#23

Post by altcognito »

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

So phishers buy domains with a levenshtein distance of 1 or two. It solves one problem, but creates an entire class of users that don't understand what a URL is. Who benefits? Google and search engine providers because now they can manipulate future internet users to believe that search engines are the internet. We've reverted to AOL in 1995.

There is nothing more that can be productively argued about this topic. There will be analogies about how complexity is hidden in various domains (cars, computers) and how beneficial it has been and how users are happy with it. Those arguments are fine and maybe they are being made in good faith, but it doesn't change the underlying future truth:

Marketing will now be changed to reflect Google keywords, not URLs. "www." and ".com" will become meaningless. Google will have put one more level of distance between what the users type in the URL and even what they click in the browser and what is reflected in the address bar.

Re: Chrome's experiment of hiding the URL is great for security

#24

Post by tokenizerrr »

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

As a developer, if this is going to hide any useful information on first glance I am not sure how I feel about that. I already feel like Chrome has started shunning developers with that over the top annoying pop-up any time I open a new window (Ctrl+N, type, stop typing because I have to move my mouse to close the popup), and moving towards forcing developers to distribute their extensions through the play store (which kills any small-time extensions for tiny communities & friends).

I appreciate trying to make Chrome more secure, but please don't forget about the developers. Annoy them too much, and they might move their development to another platform.

Re: Chrome's experiment of hiding the URL is great for security

#26

Post by espadrine »

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

My first reaction when I saw this change was, 'Oh, good, this website uses HTTPS now'. If I wasn't tech savvy, I would probably not have noticed that I was wrong. Given that, when I learned what had been done, the first thought that popped in my head was, 'Phishing only has shifted from one form of deceit to the next'.

Also, while reading Jake's post again, I realized that having the URL path colored in grey was already a big hint that something was off. Going all the way to white doesn't make a valuable difference; maybe using blue rather than grey would make the difference more striking.

I'd love to know exactly how the experimentation works. Do you perform user surveys? How do they work? What is the criterion that decides that any particular experiment failed and should be scraped off?

Re: Chrome's experiment of hiding the URL is great for security

#27

Post by aviraldg »

While I agree that this will be great for security, with changes like this I always wonder: what happens when we idiot-proof and hide implementation details of almost all consumer products? How does the next generation of hackers pop a path into a URL and learn about path traversal attacks, or code into query params and learn about XSS when we've hidden all that away from them? There's some value to that, too.

For me, that was exactly how I got interested in software development, first learnt about application security attacks, and even some scripting languages. I'm not sure any of that would've happened as well, or at all if my first device was a locked-down iPad (which it frequently is, for kids these days.)

Re: Chrome's experiment of hiding the URL is great for security

#28

Post by Pacabel »

kylemaxwell wrote: post #14
personZ wrote: post #12

Surprised to see so much attention to this: Isn't it exactly what Safari on iOS does on hundreds of millions of devices worldwide? EDIT: And given the seeming confusion by some, no, the "article" (if a couple of screenshots and some guy giving an opinion is an "article") is utterly irrelevant to this comment. Noting that it mentions iOS is meaningless. We continually see front-pagers voted up by people who seem bliss…

Did you even read the article, where that comparison is made explicit?

Not only is it explicitly stated, but it's done so in the very first sentence.

Re: Chrome's experiment of hiding the URL is great for security

#29

Post by altcognito »

DanielBMarkham wrote: post #20

I think we are confusing the fact that phishing takes place with the purpose of the web. Even if 80% of the time I was trying to be phished, I'd still want the URL. Why? Because the URL is my ownership of the web. It's my address book. It's what domain owners pay to have. It's the roads that connect one spot to another. So sure, phishing is a problem. Figure out some way around it that doesn't involve Google locking…

Many people in this thread will confuse a clean interface with convenience and sloppy conclusions for protection.

Re: Chrome's experiment of hiding the URL is great for security

#30

Post by justinschuh »

zdw wrote: post #18

I don't get the benefit to cutting off the rest of the protocol handler and path. It may be noisy and not useful to the average user, but it's useful for people who know what they're looking at. An alternative would be highlight the domain portion of the URL in the appropriate color, ala source code highlighting. This would accomplish both goals nicely.

Chrome has been highlighting the origin component and de-emphasizing the path since its initial release, but the fact is that the vast majority of users are still very unclear about the security relevance of origin and easily fall victim to phishing attacks. So, the team that's working on this is intentionally investigating larger departures from the current URL display. Accepting that, what you see right now is an incomplete experiment, and no one involved would be happy with the result if it damaged the utility of URLs or made Chrome less useful for web developers.
Post reply on HN