Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's experiment of hiding the URL is great for security

jakearchibald.com

Post reply on HN
Print view View original

141–150 of 211 posts

Re: Chrome's experiment of hiding the URL is great for security

#141

Post by diminish »

rhizome wrote: post #136
diminish wrote: post #51

Earlier quoted context omitted.

Good summary, basically the inter web linking will become: google:// keyword or better google keyword or even simply keyword

We've seen this before: http://www.musicman.com/00pic/credits.jpg

Great link... Seeing people communicate "google yourbank" and address bar becoming a search box, I thought href could be extended as an innovative technology to allow intermediated linking through a search engine.. (or Url shorteners with keywords)... But AOL already had it...

Re: Chrome's experiment of hiding the URL is great for security

#142

Post by Excavator »

cpeterso wrote: post #120
handsomeransoms wrote: post #95

Earlier quoted context omitted.

> Additionally, what about addressing insecure forms that fail to utilize https. FWIW, Firefox detects insecure login forms and emits a security warning to the web console. This is aimed at developers, however, not users (because the developers are the only ones who can improve the situation). Our heuristic is imperfect as well. We simply detect fields on http pages. This works well enough. Trying to detect when deve…

How long has Firefox been logging security warnings (in the web console) for insecure login forms? Do you know of telemetry about how prevalent the problem is or whether the security warnings have helped? I assume, for compatibility, Firefox will never be able to simply reject insecure login forms.

It looks like it's been around half a years¹. There's also a reference to the Chromium bug² for implementing the same there.

There's also mixed content blocking³ which is a similar but user facing feature.

1: https://bugzilla.mozilla.org/show_bug.cgi?id=762593

2: https://code.google.com/p/chromium/issues/detail?id=327032

3: https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-bloc...

Re: Chrome's experiment of hiding the URL is great for security

#143

Post by freshhawk »

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

"No one has any intention of diminishing usability or making it hard manipulate URLS"

Except that's exactly what's being done here. You mean that no one is twirling their moustache saying "muahahaha, soon we will make search the only way to navigate the web!" like a bond villain. Of course not, that's stupid. That's not how things happen.

People are concerned that the intention is to make changes to chrome that value the primacy and visibility of URLs fairly low compared to other factors. Everyone involved is well meaning (especially with the "won't somebody please think of the elderly!"-ness of the anti-phishing agenda), they just have an unavoidable institutional bias. It's not a coincidence that these all make the google search bar more prominent. That's valued very highly.

If your criteria value X relatively lowly and you evaluate a bunch of things which are judged with those criteria you end up diminishing X. No one cares that you didn't "intend" to do it, they care that you are doing it.

Re: Chrome's experiment of hiding the URL is great for security

#144

Post by audeyisaacs »

martey wrote: post #60
audeyisaacs wrote: post #43

Earlier quoted context omitted.

Firefox solves this rather elegantly by making the subdomain and the part after the domain light grey, with the actual root domain in black. The URL is intact, and the root domain stands out clearly.

Chrome has done this since 2010: http://chrome.blogspot.com/2010/10/understanding-omnibox-for... Firefox's implementation of this feature is at least partially because of its usage in Chrome and other browsers: https://wiki.mozilla.org/Firefox/Features/Locationbar_Domain...

OK, but my current build of Chromium also has the subdomain in black, leaving it susceptible to the trick described in the article.

The main point is that there are ways of going about this without having to kill the URL bar.

Re: Chrome's experiment of hiding the URL is great for security

#145

Post by itsravi »

rdl wrote: post #140

I hate this behavior in iOS 7 Safari so much. Whenever I want to modify the URL, it's a huge pain (on HN specific links, usually) -- there's no way to edit the parameters at the end of a URL (that I've found), and typing the whole long url on a phone or tablet isn't fun (especially when it includes lots of parameters, rather than just a simple path). It's one of the few things an alternate browser on iOS actually fix…

In Safari, you can tap the address bar and hold down on the url to bring up the pointer and scroll over to whatever you want to edit/copy. It's the same behavior in Chrome on iOS7 (apart from the fact that the pointer is at the beginning of the URL in Safari and in the end in Chrome, which albeit, is preferable).

Re: Chrome's experiment of hiding the URL is great for security

#147

Post by emil0r »

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

Why not just colour the domain?

Re: Chrome's experiment of hiding the URL is great for security

#148

Post by jsoffer »

edanm wrote: post #69

There are a number of people in this thread posting things like "the average user should be educated" and "why break things for us technically savvy people just to please people who can't be bothered to read a whole url". I really con't stand this behavior. Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines. Insisting that people are somehow…

> Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines.

I still want to support those that do, and prevent them from having unnecessary burdens on their way. Understanding how things work is hard enough already by itself.

Re: Chrome's experiment of hiding the URL is great for security

#149

Post by smsm42 »

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

I'm not sure how this would prevent phishing. 99% of people affected by phishing don't know much about URLs anyway, and legit sites routinely use weird domains like "onlinecredit6.com" or "xyznetaccess.com" which are indistinguishable from phishing ones.

I know one thing though it would prevent - if Chrome keeps doing such things that actually may force me to switch back to Firefox. Hiding URLs IMO is a horrible idea.

Re: Chrome's experiment of hiding the URL is great for security

#150

Post by ghayes »

justinschuh wrote: post #71
altcognito wrote: post #61

Earlier quoted context omitted.

What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on…

> What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The team may choose to do something like that in the end. That's really the point of experimenting with different approaches; they use them to get feedback, run user studies, and get a sense of what works best. > Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects log…

But `input[type="password"]` would cover the majority of login forms. At the least, it would force the con-artist have to mimic a native password box, which is more likely to get caught by the end-user.
Post reply on HN