Live data from Hacker News

Chrome's experiment of hiding the URL is great for security

jakearchibald.com

111–120 of 211 posts

Re: Chrome's experiment of hiding the URL is great for security

#111
post #69

There are a number of people in this thread posting things like "the average user should be educated" and "why break things for us technically savvy people just to please people who can't be bothered to read a whole url". I really con't stand this behavior. Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines. Insisting that people are somehow…

> Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines.

There are also a surprising number of people that don't want to be literate. In the modern world, we have generally regarded such views as wrong. Basic literacy is such an important skill to have, we have even created various mandates to provide the necessary education to all children.

Technology has simply added a handful of additional details. Nobody is suggesting that every has to learn all the subtleties of URLs or read RFC 1738. Much like tuning the engine in a car, these are technical details safely left to experts.

Anybody who wishes to participate in this new, technology-filled world (i.e. ~"everybody") will need to make a few minor additions to their skill-set[1]. One of these is to know what a URL is, in concept, and be able to differentiate between the host-part and the path-part. Being able to parse the path/query-string is not necessary. The necessary skill is being able to recognize that "example.com/foo/bar/baz" is more specific than "example.com", or being able to guess that "example.com/2014/04/18/the-great-quux" is probably a specific article posted last month.

This skill is important to have to participate in the modern world, not just to use a "web browser". You see URLs everywhere. Many print ads now have a URL in them, for example. This is the new literacy, de facto.

[1] Other skills might include understanding that text shaped similar to "foo@example.com" is probably an email address, how to use a mouse, and what terms such as "password" or "login" mean.

Re: Chrome's experiment of hiding the URL is great for security

#112
post #60

Earlier quoted context omitted.

Firefox solves this rather elegantly by making the subdomain and the part after the domain light grey, with the actual root domain in black. The URL is intact, and the root domain stands out clearly.

Chrome has done this since 2010: http://chrome.blogspot.com/2010/10/understanding-omnibox-for... Firefox's implementation of this feature is at least partially because of its usage in Chrome and other browsers: https://wiki.mozilla.org/Firefox/Features/Locationbar_Domain...

It was done once back in 2007 but there were a lot of complaints:

https://bugzilla.mozilla.org/show_bug.cgi?id=388135#c5

Re: Chrome's experiment of hiding the URL is great for security

#113
post #111
post #69

There are a number of people in this thread posting things like "the average user should be educated" and "why break things for us technically savvy people just to please people who can't be bothered to read a whole url". I really con't stand this behavior. Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines. Insisting that people are somehow…

> Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines. There are also a surprising number of people that don't want to be literate . In the modern world, we have generally regarded such views as wrong . Basic literacy is such an important skill to have, we have even created various mandates to provide the necessary education to all children. T…

That's a really great point, thank you.

My only possible objection is to observe that clearly some things are important/necessary to teach, others aren't, and all we're arguing about is which of these URL's fall into. Nobody here is (currently) arguing against such basic things as login's and passwords, or that "foo@example.com" should obviously to everyone be an email.

The reason I think URL's are over the line is because everything after the domain name is usually an implementation detail. Some sites will have "id=234234234", some sites will have complicated paths, some sites will have nice, readable URL's, and a large part of the difference is the specific framework or approach that the Web Devs decided to use. Do you really think it's important for people to understand the decisions behind this? That's over the line IMO.

Also, another knock against URL's being required is that, de facto, people don't understand URL's and seem to use the web just fine. That's because us selfless developers have been working hard to abstract away the issue from users. I think most users don't understand URL's, and this doesn't bother them in the least until you get to issues like phishing attacks. So all Chrome would be doing is recognizing an existing situation, and helping make it better.

Lastly, I'd like to point out that even the easy examples you mention, e.g. passwords, are something that most users don't really understand, and for exactly that reason, developers have been trying to get rid of passwords for many years. And IMO, one of the big benefits of Facebook is that it makes the "send a message to someone" game much easier than email for real users, so that's a knock against email.

I really don't think that understanding URL's is akin to being basically literate. I think the bar is much lower, and that we as developers forget just how much specialized knowledge we already know, and how much the average user already has in order to use a computer these days.

That said, it's a great analogy so thanks for bringing it up!

Re: Chrome's experiment of hiding the URL is great for security

#115

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

So phishers buy domains with a levenshtein distance of 1 or two. It solves one problem, but creates an entire class of users that don't understand what a URL is. Who benefits? Google and search engine providers because now they can manipulate future internet users to believe that search engines are the internet. We've reverted to AOL in 1995. There is nothing more that can be productively argued about this topic. The…

> but creates an entire class of users that don't understand what a URL is.

Most people have little idea what an URL is, nor how to use an address bar.

Watch a few people navigating to http://www.example.com/example.html to see what they do.

I personally have never understood the huge sums of money paid by some people for some URLs. I can't remember URLs; I can't remember keywords. What I can remember is some fragment of a page title, and I hope that's enough to find it in my bookmarks or in a websearch.

I wish Google would just release some numbers about the numbers of people who get this stuff wrong, because learning how many people use (correctly) the + operator made that change much easier to cope with.

Re: Chrome's experiment of hiding the URL is great for security

#116
post #15

Earlier quoted context omitted.

That'd be great. But so few URLs are breadcrumbable, in fact, I should fix this on my own site, http://jakearchibald.com/2014/ is a 404.

Using URL itself as a source would not work most of the time I guess, or would require assistance from Google servers. In any case, I believe breadcrumbs should be parsed from the page html: https://support.google.com/webmasters/answer/185417?hl=en

Some years back there was a proposal on one of the Mozilla blogs to use breadcrumbs when a sitemap¹ is available. I think that's a bit more reliable and would solve the 404 issue.

1: http://en.wikipedia.org/wiki/Sitemaps

Re: Chrome's experiment of hiding the URL is great for security

#117

I don't understand all the resistance to this. It's doing the work that currently all non-programmer users of the web (the vast majority) have to do themselves every time they look at a URL - parse out the meaning. For example, when my wife is checking our credit card charges, she isn't using " https://online.americanexpress.com" . She's using "Amex's website". That's how she would tell me what she's doing; that's ho…

I got it about a week and a half ago in Canary, and I stuck with it for about a week until it was disabled. I didn't like the idea but I'm interested in new UI experiments.

I hated it. Not only for the reasons other people mention (it makes copying and pasting cognitively more difficult, and even after a week it didn't really get any easier) but also because I would argue that on sites with halfway-decent URLs, it's a navigation device. We already lost the title bar, and apparently the URL bar was acting as secondary indicator of what page I'm on. It was really, really disorienting.

I do wonder whether Google only planned to display the feature for a week, or if it got feedback from my navigation habits and disabled it. And what, if any, indicators they're using to measure success. (or at least non-failure)

Re: Chrome's experiment of hiding the URL is great for security

#118
post #21

Earlier quoted context omitted.

> phishing is a very big problem Is it? What are the numbers? So many annoying things are done in the name of "security" without much justification (both online and in real life); Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help folks who can't be bothered to read it? Another comment suggests "source code highlighting" for the url, wh…

I feel I'm fairly immune to traditional phishing because I never click a URL in an email. If namecheap sends me an email saying one of my domain names is about to expire, I don't use their "Renew Now" link I go to "namecheap.com" (not hard to type), log in, and renew the name. Banks and other organizations that send long complicated links in emails and encourage people to click them are part of the reason phishing is…

plus it forces web sites to be designed in such a way to easily locate what you need, e.g. "recent transactions" shouldn't be buried deeply in the navigation tree.

Re: Chrome's experiment of hiding the URL is great for security

#119
post #10

I just hope it will still be easy to prepend urls, such as when entering reddit.com/s/URL_OF_CURRENT_PAGE

Judging from the current state, it won't. Currently, that operation requires 1 click to switch to text mode, a loong second waiting for the fucking animation to finish (who the hell puts animations in the way of user interaction?), then another click to unselect the automatically selected URL.

Chrome isn't hotkey capable?

Ctrl+L -> Home key -> Type reddit.com/ -> Enter key

Re: Chrome's experiment of hiding the URL is great for security

#120

Earlier quoted context omitted.

What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on…

> Additionally, what about addressing insecure forms that fail to utilize https. FWIW, Firefox detects insecure login forms and emits a security warning to the web console. This is aimed at developers, however, not users (because the developers are the only ones who can improve the situation). Our heuristic is imperfect as well. We simply detect fields on http pages. This works well enough. Trying to detect when deve…

How long has Firefox been logging security warnings (in the web console) for insecure login forms? Do you know of telemetry about how prevalent the problem is or whether the security warnings have helped? I assume, for compatibility, Firefox will never be able to simply reject insecure login forms.
Post reply on HN