Chrome's experiment of hiding the URL is great for security • Hacker News Board

Re: Chrome's experiment of hiding the URL is great for security

#101

Post by baddox » Sun, May 04, 2014, 4:12 PM UTC

AdrianRossouw wrote: post #34

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

respectfully ... chrome is already breaking half of the copy/pastes i do because it's from my history and not a page that's already loaded. do you have any idea how many people actually use copy/paste? i would venture that ctrl-c/ctrl-v is probably the only key binding that the majority of computer users of all walks of life use. half of the places i seem to be pasting links into don't pick up the links without the h…

Why should it make copying, pasting, or editing URLs more difficult? Right now in stable Chrome, you click once on the URL bar and it selects the entire URL. Then you can Ctrl-C to copy, Ctrl-V to paste, or click again to put the cursor in a specific place to edit it. That shouldn't be any different with this new Chrome feature they're testing.

Re: Chrome's experiment of hiding the URL is great for security

#102

Post by sergiosgc » Sun, May 04, 2014, 4:13 PM UTC

altcognito wrote: post #61

justinschuh wrote: post #50

Earlier quoted context omitted.

I agree that this experiment isn't demonstrating a perfect mitigation, but it's important to appreciate that it's currently vastly easier for a phisher to permute paths and subdomain components than it is to create a convincing ETLD+1. There are various reasons for this, including less text for a phisher to work with and registration requirements for ETLD+1 domains (which means they can't be iterated and dumped as qu…

What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on…

I'd say that is the best solution, possibly with more work done on the certificate button left of the url. The button currently highlights “good“ sites: https with an Extended Validation certificate. It should be the other way around. Highlight as warning when the site falls short: no SSL or SSL without EV.

Re: Chrome's experiment of hiding the URL is great for security

#103

Post by baddox » Sun, May 04, 2014, 4:14 PM UTC

higherpurpose wrote: post #47

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

You want to help people feel more secure? How about you downgrade every https website to Yellow color, unless it uses PFS (only with a few good cipher-suits) and the latest version of TLS. Requiring HSTS would probably be good, too. They should also be required to have 100 percent of the site under https, before getting the Green color. No mixed content. Right now you (and other browsers, too) give the "safe" color G…

What percentage of big websites (say, top 100 sites and top 100 e-commerce sites) use HTTPS without PFS? If it's significant, then the yellow will just become meaningless.

Re: Chrome's experiment of hiding the URL is great for security

#104

Post by kiallmacinnes » Sun, May 04, 2014, 4:18 PM UTC

diminish wrote: post #45

justinschuh wrote: post #39

Earlier quoted context omitted.

> Is it? What are the numbers? Providing more detailed background and better numbers on phishing sounds like a good idea. However, this is an experiment that is not on track to ship in any version of Chrome, so I wouldn't consider it a gating criteria for continuing to experiment. > Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help fol…

So you think crackers(>hackers) and people with bad intention will be unable to see the URLs and won't be able to do phishing easily. So, through obscurity you will achieve security. Edit: or you expect users to notice phishing attempts more clearly by only displaying the domain name?

I'm not sure you quite understand!

The intent isn't to hide the URL from technical people like scammers... Its to hide it from nontechnical people. It's easier to train your grandparents to look at a shortened URL containing just the domain name, and having them verify that is what they expect - as all the distracting bits of the URL are gone...

(Also - "crackers" refers to a very different group of people....)

Re: Chrome's experiment of hiding the URL is great for security

#105

Post by baddox » Sun, May 04, 2014, 4:19 PM UTC

altcognito wrote: post #75

edanm wrote: post #69

There are a number of people in this thread posting things like "the average user should be educated" and "why break things for us technically savvy people just to please people who can't be bothered to read a whole url". I really con't stand this behavior. Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines. Insisting that people are somehow…

Nobody is asking people to understand the HTTP protocol. This is understanding how information is addressed in the 21st century. The more apt comparison might be physical mail addresses. People should understand (and it is taught in schools!) the basic format and the structure of it. We don't ask them to understand (in the states) the layout of zip codes, but we do expect them to understand that the first line refers…

If there was some level of abstraction/automation to allow addressing physical mail without knowing street numbers, zip codes, etc., I would be fine with that. I imagine there is actually a lot of problems with mail delivery because of the messiness of addresses. I've encountered it a few times in the USA (some carriers want "Route P" but some want "Highway P," and some want "Suite 404" but some want "4th Floor"), and I bet it can get even messier, especially in poorer countries.

Re: Chrome's experiment of hiding the URL is great for security

#106

Post by sergiosgc » Sun, May 04, 2014, 4:25 PM UTC

hugi wrote: post #5

Jugurtha wrote: post #2

I don't like it. I like control, and this hides stuff from me. It's basically telling you: "You don't need to see this, kid. We got it".

That's the point. And for most users that's great.

No it's not. URLs enable users to link to content. People blog, email, post to Facebook, do all kinds of linking. And no, it's not always using the FB/Twitter buttons. They do know that a url is an address and what an address is for.

If you tell me the url is still accessible, you are contradicting yourself.

Re: Chrome's experiment of hiding the URL is great for security

#107

Post by jiggy2011 » Sun, May 04, 2014, 4:32 PM UTC

edanm wrote: post #77

altcognito wrote: post #75

Earlier quoted context omitted.

Nobody is asking people to understand the HTTP protocol. This is understanding how information is addressed in the 21st century. The more apt comparison might be physical mail addresses. People should understand (and it is taught in schools!) the basic format and the structure of it. We don't ask them to understand (in the states) the layout of zip codes, but we do expect them to understand that the first line refers…

While I would love for the simple idea of the URL scheme to be something everyone understands, I highly doubt it's every going to happen. I'm sad about this, but I live in the real world with real people, and I've seen the kind of stuff they do and don't learn, whether by ability or by inclination.

You might not be giving people enough credit, people without CS degrees have been using URLs in emails and forum posts to link to information for years.

Re: Chrome's experiment of hiding the URL is great for security

#108

Post by marcosdumay » Sun, May 04, 2014, 4:49 PM UTC

spindritf wrote: post #53

I followed the link, entered my username and was about to enter my password. This is the problem demanding a real solution, not some cosmetic change around the URL. Your browser should be entering the credentials. The computer is not fooled by an ugly URL. If the domain doesn't match, no password for you. If the protocol is different from the one you used the first time (https hopefully), no password for you. Yet ins…

We also shouldn't be sending our credentials to any site where we authenticate. Passwords are just plain wrong.

Re: Chrome's experiment of hiding the URL is great for security

#109

Post by ams6110 » Sun, May 04, 2014, 4:57 PM UTC

bambax wrote: post #21

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

> phishing is a very big problem Is it? What are the numbers? So many annoying things are done in the name of "security" without much justification (both online and in real life); Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help folks who can't be bothered to read it? Another comment suggests "source code highlighting" for the url, wh…

I feel I'm fairly immune to traditional phishing because I never click a URL in an email. If namecheap sends me an email saying one of my domain names is about to expire, I don't use their "Renew Now" link I go to "namecheap.com" (not hard to type), log in, and renew the name. Banks and other organizations that send long complicated links in emails and encourage people to click them are part of the reason phishing is possible. These emails should look like:

Dear John Doe,

An automatic payment has been made from your checking account:

04-May-2014 $125.00 to Big Energy Utility Corp

For more details, please log on to your online banking account and click the "Recent Transactions" tab.

There is no need for hyperlinks in any of that.

Re: Chrome's experiment of hiding the URL is great for security

#110

Post by ardemue » Sun, May 04, 2014, 5:01 PM UTC

aviraldg wrote: post #27

While I agree that this will be great for security, with changes like this I always wonder: what happens when we idiot-proof and hide implementation details of almost all consumer products? How does the next generation of hackers pop a path into a URL and learn about path traversal attacks, or code into query params and learn about XSS when we've hidden all that away from them? There's some value to that, too. For me…

Maybe that's the regular path of any technology. At first most of the community is small and technical so you don't need (and don't have the means anyway) to idiotproof. Then it grows and eventually there are more casual users than technical ones. Since the technology is more stable you have more ressources that you can dedicate to figuring out how your casual users use the technology. And since they have no interest in understanding how it works, you idiotproof.

The beauty of it is that it regulates the number of potential technical users. At first, your technology needs a lot of technical users, and since it's not idiotproofed yet, and users are exposed to low level details, you attract a lot of them. But then, low level details are progressively hidden, and only the users that have a strong interest will become technical. Essentially filtering out the users that don't have a strong enough interest to dive deeper than what they're exposed to.

Maybe the internet doesn't need as much technical users as before. So yes, there will be less kids getting interested in its technical side, but that's okay because it doesn't need them.