Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's experiment of hiding the URL is great for security

jakearchibald.com

Post reply on HN
Print view View original

81–90 of 211 posts

Re: Chrome's experiment of hiding the URL is great for security

#81

Post by altcognito »

edanm wrote: post #77
altcognito wrote: post #75

Earlier quoted context omitted.

Nobody is asking people to understand the HTTP protocol. This is understanding how information is addressed in the 21st century. The more apt comparison might be physical mail addresses. People should understand (and it is taught in schools!) the basic format and the structure of it. We don't ask them to understand (in the states) the layout of zip codes, but we do expect them to understand that the first line refers…

While I would love for the simple idea of the URL scheme to be something everyone understands, I highly doubt it's every going to happen. I'm sad about this, but I live in the real world with real people, and I've seen the kind of stuff they do and don't learn, whether by ability or by inclination.

What's sad is that we've had URL schemes for 20 years and they aren't taught in school. Also sad is many people think we teaching algebra and calculus secondary education is a given but basic concepts like domain names in a URL are "too complicated" for the real world.

Re: Chrome's experiment of hiding the URL is great for security

#82

Post by Touche »

chestnut-tree wrote: post #74
justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

"...the whole point is to prevent phishing" URLs are the bread-and-butter of the web. Surely, you don't have to hide the whole URL? Why not simply show the whole URL but visually emphasise the domain in some way so it stands out. Make it easy to read the whole URL while emphasizing the domain (i.e. don't fade out the rest of the URL so its too faint to read). There are other ways of tackle phishing too. If most phisi…

That's what I'm thinking too. Why not make the domain rainbow colored and blinking if that's what it takes to stand out. It doesn't mean the rest of the url has to be absent entirely.

Re: Chrome's experiment of hiding the URL is great for security

#83

Post by Touche »

martey wrote: post #60
audeyisaacs wrote: post #43

Earlier quoted context omitted.

Firefox solves this rather elegantly by making the subdomain and the part after the domain light grey, with the actual root domain in black. The URL is intact, and the root domain stands out clearly.

Chrome has done this since 2010: http://chrome.blogspot.com/2010/10/understanding-omnibox-for... Firefox's implementation of this feature is at least partially because of its usage in Chrome and other browsers: https://wiki.mozilla.org/Firefox/Features/Locationbar_Domain...

There's not enough contrast between them to really tell the difference unless you look closely.

Re: Chrome's experiment of hiding the URL is great for security

#84

Post by edanm »

altcognito wrote: post #81
edanm wrote: post #77

Earlier quoted context omitted.

While I would love for the simple idea of the URL scheme to be something everyone understands, I highly doubt it's every going to happen. I'm sad about this, but I live in the real world with real people, and I've seen the kind of stuff they do and don't learn, whether by ability or by inclination.

What's sad is that we've had URL schemes for 20 years and they aren't taught in school. Also sad is many people think we teaching algebra and calculus secondary education is a given but basic concepts like domain names in a URL are "too complicated" for the real world.

I get where you're coming from, and I'm not sure whether I agree or not.

Personally, I think modern education is wrong-headed time most of the time, but I'm not sure I'd switch to teaching URL schemes if I was overlord of the universe. I'd much more likely insist on teaching the basics of economics, finance, logic, rationality, human psychology, etc.

URLs would still be far down my list.

Re: Chrome's experiment of hiding the URL is great for security

#85

Post by Touche »

justinschuh wrote: post #30
zdw wrote: post #18

I don't get the benefit to cutting off the rest of the protocol handler and path. It may be noisy and not useful to the average user, but it's useful for people who know what they're looking at. An alternative would be highlight the domain portion of the URL in the appropriate color, ala source code highlighting. This would accomplish both goals nicely.

Chrome has been highlighting the origin component and de-emphasizing the path since its initial release, but the fact is that the vast majority of users are still very unclear about the security relevance of origin and easily fall victim to phishing attacks. So, the team that's working on this is intentionally investigating larger departures from the current URL display. Accepting that, what you see right now is an i…

> Chrome has bee highlighting the origin component and de-emphasizing the path since its initial release, but the fact is that the vast majority of users are still very unclear about the security relevance of origin and easily fall victim to phishing attacks.

Barely. There's very little contrast between the two parts, not enough that you would notice that there is a difference unless you look very closely.

Re: Chrome's experiment of hiding the URL is great for security

#86

Post by dlisboa »

edanm wrote: post #84
altcognito wrote: post #81

Earlier quoted context omitted.

What's sad is that we've had URL schemes for 20 years and they aren't taught in school. Also sad is many people think we teaching algebra and calculus secondary education is a given but basic concepts like domain names in a URL are "too complicated" for the real world.

I get where you're coming from, and I'm not sure whether I agree or not. Personally, I think modern education is wrong-headed time most of the time, but I'm not sure I'd switch to teaching URL schemes if I was overlord of the universe. I'd much more likely insist on teaching the basics of economics, finance, logic, rationality, human psychology, etc. URLs would still be far down my list.

Basic URLs take literally a single day to teach. The people you're teaching them to already have more contact to them than almost anyone else. Schools already have computer classes (or should have anyway).

Then you want to teach them basic finance so they can't throw away their money, except on a phishing attack? We should make users more powerful, not take away everything that can hurt them like hiding pointy triangles from kids.

Re: Chrome's experiment of hiding the URL is great for security

#87

Post by bambax »

tl wrote: post #46
justinschuh wrote: post #39

Earlier quoted context omitted.

> Is it? What are the numbers? Providing more detailed background and better numbers on phishing sounds like a good idea. However, this is an experiment that is not on track to ship in any version of Chrome, so I wouldn't consider it a gating criteria for continuing to experiment. > Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help fol…

If black vs. light grey is your concept of "highlighting" then I have to tell that I didn't even notice the behavior until today. Maybe you should try actual color before removing functionally?

Seconded. The current situation doesn't appear to warrant the term "highlighting"...

Re: Chrome's experiment of hiding the URL is great for security

#88

Post by DerpDerpDerp »

justinschuh wrote: post #16
relate wrote: post #10

I just hope it will still be easy to prepend urls, such as when entering reddit.com/s/URL_OF_CURRENT_PAGE

This is an in-development experiment, so its current state is a work in progress. Anything that would ship to users (assuming it even does) would do so in a way that does not damage the general utility of URLs.

After dealing with YouTube for the past year, I'm very skeptical Google won't mangle a UI/platform for "the good of the common user".

Re: Chrome's experiment of hiding the URL is great for security

#89

Post by gkya »

Touche wrote: post #85
justinschuh wrote: post #30

Earlier quoted context omitted.

Chrome has been highlighting the origin component and de-emphasizing the path since its initial release, but the fact is that the vast majority of users are still very unclear about the security relevance of origin and easily fall victim to phishing attacks. So, the team that's working on this is intentionally investigating larger departures from the current URL display. Accepting that, what you see right now is an i…

> Chrome has bee highlighting the origin component and de-emphasizing the path since its initial release, but the fact is that the vast majority of users are still very unclear about the security relevance of origin and easily fall victim to phishing attacks. Barely. There's very little contrast between the two parts, not enough that you would notice that there is a difference unless you look very closely.

Everybody is complaining about the lack of contrast between the root domain and the rest of the domain in the URL bar. I reckon, both in Chrome and in Firefox, there is quite noticeable contrast between the root domain and the path/subdomain. If the contrast was bigger, then the path would be unreadable, which undesirable too.

Re: Chrome's experiment of hiding the URL is great for security

#90

Post by acdha »

aw3c2 wrote: post #37

So I will register "benefltaccess.com" as "Morgan Staniey". Would the people who fall for phishing actually notice? I think removing URLs just feeds into Google's "door to the internet" monopoly and really dislike it. People should rather be educated about how websites actually work.

> So I will register "benefltaccess.com" as "Morgan Staniey".

Have you actually tried doing this? Getting an EV certificate with the business name involves actual checks, not just having registered a domain.

Post reply on HN