Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's experiment of hiding the URL is great for security

jakearchibald.com

Post reply on HN
Print view View original

91–100 of 211 posts

Re: Chrome's experiment of hiding the URL is great for security

#91

Post by tokenizerrr »

justinschuh wrote: post #72
tokenizerrr wrote: post #24

Earlier quoted context omitted.

As a developer, if this is going to hide any useful information on first glance I am not sure how I feel about that. I already feel like Chrome has started shunning developers with that over the top annoying pop-up any time I open a new window (Ctrl+N, type, stop typing because I have to move my mouse to close the popup), and moving towards forcing developers to distribute their extensions through the play store (whi…

What is the popup you're encountering? Because it sounds like a bug, and I'd like to make sure someone is working on fixing it (or has already done so).

The popup that urges me to disable the extensions I am developing: http://i.imgur.com/4tBDrVw.png

I just tried to reproduce it, and it doesn't seem to actually happen for every new window I open, so I am not sure what I am doing to trigger it, but I do encounter it several times a day.

edit: Incognito seems to do it, which makes sense because I often enter/leave incognito to make sure I have a fresh cache & no cookies when testing.

Re: Chrome's experiment of hiding the URL is great for security

#92

Post by NaNaN »

artursapek wrote: post #66
TazeTSchnitzel wrote: post #58

Earlier quoted context omitted.

I like how myself and my (not all technical) friends know what URLs are and can copy them if they want to link me to something. Now they probably won't be able to figure out how.

Have you even tried using this feature? You can enable it in chrome://flags. You can still copy and paste the URL just fine. Thanks for the downvote. I'd love to hear you refute my argument, rather than spew nonsense complaints.

chrome://flags/#origin-chip-in-omnibox

Re: Chrome's experiment of hiding the URL is great for security

#93

Post by Touche »

gkya wrote: post #89
Touche wrote: post #85

Earlier quoted context omitted.

> Chrome has bee highlighting the origin component and de-emphasizing the path since its initial release, but the fact is that the vast majority of users are still very unclear about the security relevance of origin and easily fall victim to phishing attacks. Barely. There's very little contrast between the two parts, not enough that you would notice that there is a difference unless you look very closely.

Everybody is complaining about the lack of contrast between the root domain and the rest of the domain in the URL bar. I reckon, both in Chrome and in Firefox, there is quite noticeable contrast between the root domain and the path/subdomain. If the contrast was bigger, then the path would be unreadable, which undesirable too.

In Chrome the domain is black and the path is grey. You could make one red and the other green and that would be actual contrast. Or give the domain a background and border. There's more ways to contrast things than adjusting the lightness of black.

Re: Chrome's experiment of hiding the URL is great for security

#94

Post by leoc »

People want to find a way to continue showing the path portion of the URL, but this is really undesirable. The URL's path should contain no information, beyond its role in making up the unique identifier of course; it's a virtual guarantee of link-breakage in the future https://news.ycombinator.com/reply?id=7679423 . Making it invisible will help to ensure that people stop putting information in it. User-friendly document names and tree-structured site guides are all well and good; they just don't belong in the URL. The query string, on the other hand, should probably remain visible.

Re: Chrome's experiment of hiding the URL is great for security

#95

Post by handsomeransoms »

altcognito wrote: post #61
justinschuh wrote: post #50

Earlier quoted context omitted.

I agree that this experiment isn't demonstrating a perfect mitigation, but it's important to appreciate that it's currently vastly easier for a phisher to permute paths and subdomain components than it is to create a convincing ETLD+1. There are various reasons for this, including less text for a phisher to work with and registration requirements for ETLD+1 domains (which means they can't be iterated and dumped as qu…

What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on…

> Additionally, what about addressing insecure forms that fail to utilize https.

FWIW, Firefox detects insecure login forms and emits a security warning to the web console. This is aimed at developers, however, not users (because the developers are the only ones who can improve the situation).

Our heuristic is imperfect as well. We simply detect fields on http pages. This works well enough. Trying to detect when developers are abusing for a password field is non-trivial.

Re: Chrome's experiment of hiding the URL is great for security

#96

Post by altcognito »

justinschuh wrote: post #71
altcognito wrote: post #61

Earlier quoted context omitted.

What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on…

> What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The team may choose to do something like that in the end. That's really the point of experimenting with different approaches; they use them to get feedback, run user studies, and get a sense of what works best. > Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects log…

> That's actually very, very hard (as in np-hard). Chrome has heuristics for detecting login pages, but it doesn't even detect all legitimate login pages. And it's trivial for a phisher to intentionally make a page that appears exactly like a login page to the user, but will not be detected by Chrome's heuristics.

Well, it wouldn't have to detect all login pages, it could just detect most of them. That would add soft pressure to encourage regular websites to use HTTPS in the vein of

https://www.eff.org/https-everywhere

Hopefully we can push the web towards https everywhere, and users begin to ask the question -- "Why is this page not secure" when performing a login.

This soft pressure worked wonders in a number of places: When Google started doing sitelinks, many websites became much more concerned about making those available on their website. In a similar way, hopefully they would be concerned with getting out of the red for their login pages.

Re: Chrome's experiment of hiding the URL is great for security

#97

Post by leoc »

chr1 wrote: post #73
justinschuh wrote: post #30

Earlier quoted context omitted.

Chrome has been highlighting the origin component and de-emphasizing the path since its initial release, but the fact is that the vast majority of users are still very unclear about the security relevance of origin and easily fall victim to phishing attacks. So, the team that's working on this is intentionally investigating larger departures from the current URL display. Accepting that, what you see right now is an i…

chrome keeps both domain and subdomain black, which makes this kind of phishing easy. Firefox have a better approach of keeping black only the main part, and graying out everything else. Yet better solution would be to highlight domain with green color instead of https:// , and to scroll urls with very long subdomain to make domain viible. I rather liked how this[1] firefox addon added a bubble around domain, but kep…

An approach like greying out the path would be a good idea if it were in any way desirable for the path to be user-visible by default, but it isn't.

Re: Chrome's experiment of hiding the URL is great for security

#99

Post by baddox »

altcognito wrote: post #23
justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

So phishers buy domains with a levenshtein distance of 1 or two. It solves one problem, but creates an entire class of users that don't understand what a URL is. Who benefits? Google and search engine providers because now they can manipulate future internet users to believe that search engines are the internet. We've reverted to AOL in 1995. There is nothing more that can be productively argued about this topic. The…

There is more that can be productively argued about this topic, at least for parties who decide to not insist otherwise. URLs won't go away as long as people are still sharing websites on social networks or their own websites. I don't see the problem with not displaying the entire URL at the top of the browser window, if no actual functionality it lost. I this case, there's not even any additional clicks required to perform the same operations with URLs.

Re: Chrome's experiment of hiding the URL is great for security

#100

Post by baddox »

justinschuh wrote: post #71
altcognito wrote: post #61

Earlier quoted context omitted.

What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on…

> What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The team may choose to do something like that in the end. That's really the point of experimenting with different approaches; they use them to get feedback, run user studies, and get a sense of what works best. > Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects log…

It's not even NP-hard, because it's not well-defined and thus isn't even a decision problem.
Post reply on HN