Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's experiment of hiding the URL is great for security

jakearchibald.com

Post reply on HN
Print view View original

71–80 of 211 posts

Re: Chrome's experiment of hiding the URL is great for security

#71

Post by justinschuh »

altcognito wrote: post #61
justinschuh wrote: post #50

Earlier quoted context omitted.

I agree that this experiment isn't demonstrating a perfect mitigation, but it's important to appreciate that it's currently vastly easier for a phisher to permute paths and subdomain components than it is to create a convincing ETLD+1. There are various reasons for this, including less text for a phisher to work with and registration requirements for ETLD+1 domains (which means they can't be iterated and dumped as qu…

What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on…

> What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857

The team may choose to do something like that in the end. That's really the point of experimenting with different approaches; they use them to get feedback, run user studies, and get a sense of what works best.

> Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on a login page.

That's actually very, very hard (as in np-hard). Chrome has heuristics for detecting login pages, but it doesn't even detect all legitimate login pages. And it's trivial for a phisher to intentionally make a page that appears exactly like a login page to the user, but will not be detected by Chrome's heuristics.

Re: Chrome's experiment of hiding the URL is great for security

#72

Post by justinschuh »

tokenizerrr wrote: post #24
justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

As a developer, if this is going to hide any useful information on first glance I am not sure how I feel about that. I already feel like Chrome has started shunning developers with that over the top annoying pop-up any time I open a new window (Ctrl+N, type, stop typing because I have to move my mouse to close the popup), and moving towards forcing developers to distribute their extensions through the play store (whi…

What is the popup you're encountering? Because it sounds like a bug, and I'd like to make sure someone is working on fixing it (or has already done so).

Re: Chrome's experiment of hiding the URL is great for security

#73

Post by chr1 »

justinschuh wrote: post #30
zdw wrote: post #18

I don't get the benefit to cutting off the rest of the protocol handler and path. It may be noisy and not useful to the average user, but it's useful for people who know what they're looking at. An alternative would be highlight the domain portion of the URL in the appropriate color, ala source code highlighting. This would accomplish both goals nicely.

Chrome has been highlighting the origin component and de-emphasizing the path since its initial release, but the fact is that the vast majority of users are still very unclear about the security relevance of origin and easily fall victim to phishing attacks. So, the team that's working on this is intentionally investigating larger departures from the current URL display. Accepting that, what you see right now is an i…

chrome keeps both domain and subdomain black, which makes this kind of phishing easy. Firefox have a better approach of keeping black only the main part, and graying out everything else. Yet better solution would be to highlight domain with green color instead of https://, and to scroll urls with very long subdomain to make domain viible.

I rather liked how this[1] firefox addon added a bubble around domain, but kept url as selectable text.

[1] https://addons.mozilla.org/en-US/firefox/addon/smart-text/

Re: Chrome's experiment of hiding the URL is great for security

#74

Post by chestnut-tree »

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

"...the whole point is to prevent phishing"

URLs are the bread-and-butter of the web. Surely, you don't have to hide the whole URL? Why not simply show the whole URL but visually emphasise the domain in some way so it stands out. Make it easy to read the whole URL while emphasizing the domain (i.e. don't fade out the rest of the URL so its too faint to read).

There are other ways of tackle phishing too. If most phising occurs when you click links in your email, then email providers could display an intermediary page before you're taken to the destination link. The intermediary page tells you the domain you're being taken to: you click a PayPal link and the intermediary page states you are about to be taken to sharkventures. This could of course be very annoying for every web link and some users won't read email re-direct messages, but it's another approach.

Re: Chrome's experiment of hiding the URL is great for security

#75

Post by altcognito »

edanm wrote: post #69

There are a number of people in this thread posting things like "the average user should be educated" and "why break things for us technically savvy people just to please people who can't be bothered to read a whole url". I really con't stand this behavior. Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines. Insisting that people are somehow…

Nobody is asking people to understand the HTTP protocol. This is understanding how information is addressed in the 21st century.

The more apt comparison might be physical mail addresses. People should understand (and it is taught in schools!) the basic format and the structure of it. We don't ask them to understand (in the states) the layout of zip codes, but we do expect them to understand that the first line refers to street address.

Similarly, we can do the same education for information today. We can explain the design behind the structure, the beauty and simplicity in URL design. (not always, I get that) Or, we can just continue on the path we're headed and tell users: "just type this into the search bar (Google), and a website comes back, along with some ads (probably)".

Re: Chrome's experiment of hiding the URL is great for security

#76

Post by gcr »

zdw wrote: post #18

I don't get the benefit to cutting off the rest of the protocol handler and path. It may be noisy and not useful to the average user, but it's useful for people who know what they're looking at. An alternative would be highlight the domain portion of the URL in the appropriate color, ala source code highlighting. This would accomplish both goals nicely.

Devs can just press ^L to select the URL, I think. That's what I do when I need to change/manipulate/view it anyway.

Re: Chrome's experiment of hiding the URL is great for security

#77

Post by edanm »

altcognito wrote: post #75
edanm wrote: post #69

There are a number of people in this thread posting things like "the average user should be educated" and "why break things for us technically savvy people just to please people who can't be bothered to read a whole url". I really con't stand this behavior. Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines. Insisting that people are somehow…

Nobody is asking people to understand the HTTP protocol. This is understanding how information is addressed in the 21st century. The more apt comparison might be physical mail addresses. People should understand (and it is taught in schools!) the basic format and the structure of it. We don't ask them to understand (in the states) the layout of zip codes, but we do expect them to understand that the first line refers…

While I would love for the simple idea of the URL scheme to be something everyone understands, I highly doubt it's every going to happen. I'm sad about this, but I live in the real world with real people, and I've seen the kind of stuff they do and don't learn, whether by ability or by inclination.

Re: Chrome's experiment of hiding the URL is great for security

#78

Post by kevingadd »

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

Calling this a phishing mitigation is blatantly dishonest. Hiding the URL does nothing to stop phishing. UX improvements are great, and this is clearly a UX change designed to perform great on metrics Google cares about (like search traffic), but it is not anything resembling an attack mitigation.

Here are some things that actively mitigate phishing; many of them available in Chrome and actively used by many web properties (including Google's).

HttpOnly cookies (introduced in 2002!)

'secure' cookies

Content Security Policy

iframe sandboxing

input sanitization

isolating user input to low-privilege domains to protect unsecured user information

clear, identifiable URLs that increase the odds of users recognizing something wrong

two-factor authentication

What is an example of a phishing attack or XSS attack that would be stopped by this change? Is there at least an example of an attack that would be mitigated? I cannot for the life of me think of one.

Re: Chrome's experiment of hiding the URL is great for security

#79

Post by revelation »

relate wrote: post #10

I just hope it will still be easy to prepend urls, such as when entering reddit.com/s/URL_OF_CURRENT_PAGE

Judging from the current state, it won't. Currently, that operation requires 1 click to switch to text mode, a loong second waiting for the fucking animation to finish (who the hell puts animations in the way of user interaction?), then another click to unselect the automatically selected URL.
Post reply on HN