Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's experiment of hiding the URL is great for security

jakearchibald.com

Post reply on HN
Print view View original

51–60 of 211 posts

Re: Chrome's experiment of hiding the URL is great for security

#51

Post by diminish »

altcognito wrote: post #23
justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

So phishers buy domains with a levenshtein distance of 1 or two. It solves one problem, but creates an entire class of users that don't understand what a URL is. Who benefits? Google and search engine providers because now they can manipulate future internet users to believe that search engines are the internet. We've reverted to AOL in 1995. There is nothing more that can be productively argued about this topic. The…

Good summary, basically the inter web linking will become:

google://keyword

or better

google keyword

or even simply

keyword

Re: Chrome's experiment of hiding the URL is great for security

#52

Post by johncoltrane »

ojii wrote: post #48
pbz wrote: post #42

Earlier quoted context omitted.

Well, if www and .com become meaningless then advertisers will use "type xxx yyy into you bar" instead (which goes to the search engine) or hash tags (already doing this). Then Google could come up with "associate permanent keywords with your URL" (for a small fee of course) to guarantee that those keywords won't shift under you when your Google ranking changes.

I already see this happening in Japan. Rarely do I see ads include URLs, they have a search term.

Which IMO is a smart idea. URLs are too often hard to remember and/or type correctly if not too long anyway.

Re: Chrome's experiment of hiding the URL is great for security

#53

Post by spindritf »

I followed the link, entered my username and was about to enter my password.

This is the problem demanding a real solution, not some cosmetic change around the URL. Your browser should be entering the credentials.

The computer is not fooled by an ugly URL. If the domain doesn't match, no password for you. If the protocol is different from the one you used the first time (https hopefully), no password for you.

Yet instead, we get autocomplete="off" and a butchered URL bar.

Re: Chrome's experiment of hiding the URL is great for security

#54

Post by flurpitude »

audeyisaacs wrote: post #43
justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

Firefox solves this rather elegantly by making the subdomain and the part after the domain light grey, with the actual root domain in black. The URL is intact, and the root domain stands out clearly.

It's a start but I hadn't noticed this feature and wouldn't notice if the whole URL were in black. Using different colours to highlight different parts of the URL would be a big improvement.

Re: Chrome's experiment of hiding the URL is great for security

#55

Post by runn1ng »

diminish wrote: post #45
justinschuh wrote: post #39

Earlier quoted context omitted.

> Is it? What are the numbers? Providing more detailed background and better numbers on phishing sounds like a good idea. However, this is an experiment that is not on track to ship in any version of Chrome, so I wouldn't consider it a gating criteria for continuing to experiment. > Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help fol…

So you think crackers(>hackers) and people with bad intention will be unable to see the URLs and won't be able to do phishing easily. So, through obscurity you will achieve security. Edit: or you expect users to notice phishing attempts more clearly by only displaying the domain name?

I am not sure the "security/obscurity" logic applies here.

It's all just GUI change, nothing is really obscured (as in not accessible). It's just more radically highlighted.

Re: Chrome's experiment of hiding the URL is great for security

#56

Post by artursapek »

I don't understand all the resistance to this. It's doing the work that currently all non-programmer users of the web (the vast majority) have to do themselves every time they look at a URL - parse out the meaning.

For example, when my wife is checking our credit card charges, she isn't using "https://online.americanexpress.com". She's using "Amex's website". That's how she would tell me what she's doing; that's how she thinks about it. She doesn't give a damn what the URL is, and that's why phishing works in the first place.

This new UI simply reflects how most people think about the web.

Everyone on HN who has been arguing against this is missing a huge point: this isn't for you. We still do everything in our terminals for Christ's sake. Nobody has taken that away from us. Nobody is going to take URLs away either. But just like the terminal application they will be shuffled away into a "utilities" drawer where you have to look for them because they were designed for machines, not people. Those of us who work with machines can still have them.

I can't wait for this to ship.

Re: Chrome's experiment of hiding the URL is great for security

#57

Post by TazeTSchnitzel »

jaffathecake wrote: post #11
eknkc wrote: post #8

A native breadcrumbs display might be a great addition to this. I mean, show the domain first, and show a subsection that the website provides, so I can click on that to navigate. If I click on the domain name, provide a standard url input field. Google already does that with search results: http://d.ekin.io/bOdk

That'd be great. But so few URLs are breadcrumbable, in fact, I should fix this on my own site, http://jakearchibald.com/2014/ is a 404.

Having comments on the 404 page is a brilliant idea. More websites should do this!

Re: Chrome's experiment of hiding the URL is great for security

#58

Post by TazeTSchnitzel »

artursapek wrote: post #56

I don't understand all the resistance to this. It's doing the work that currently all non-programmer users of the web (the vast majority) have to do themselves every time they look at a URL - parse out the meaning. For example, when my wife is checking our credit card charges, she isn't using " https://online.americanexpress.com" . She's using "Amex's website". That's how she would tell me what she's doing; that's ho…

I like how myself and my (not all technical) friends know what URLs are and can copy them if they want to link me to something.

Now they probably won't be able to figure out how.

Re: Chrome's experiment of hiding the URL is great for security

#59

Post by opium_tea »

diminish wrote: post #45
justinschuh wrote: post #39

Earlier quoted context omitted.

> Is it? What are the numbers? Providing more detailed background and better numbers on phishing sounds like a good idea. However, this is an experiment that is not on track to ship in any version of Chrome, so I wouldn't consider it a gating criteria for continuing to experiment. > Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help fol…

So you think crackers(>hackers) and people with bad intention will be unable to see the URLs and won't be able to do phishing easily. So, through obscurity you will achieve security. Edit: or you expect users to notice phishing attempts more clearly by only displaying the domain name?

It's the latter. By only displaying the domain name users are more likely to notice a scam domain name, e.g. the Halifax.co.uk case in the parent blog post.

Re: Chrome's experiment of hiding the URL is great for security

#60

Post by martey »

audeyisaacs wrote: post #43
justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

Firefox solves this rather elegantly by making the subdomain and the part after the domain light grey, with the actual root domain in black. The URL is intact, and the root domain stands out clearly.

Chrome has done this since 2010: http://chrome.blogspot.com/2010/10/understanding-omnibox-for...

Firefox's implementation of this feature is at least partially because of its usage in Chrome and other browsers: https://wiki.mozilla.org/Firefox/Features/Locationbar_Domain...

Post reply on HN