Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's experiment of hiding the URL is great for security

jakearchibald.com

Post reply on HN
Print view View original

161–170 of 211 posts

Re: Chrome's experiment of hiding the URL is great for security

#161

Post by nodata »

ghayes wrote: post #150
justinschuh wrote: post #71

Earlier quoted context omitted.

> What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The team may choose to do something like that in the end. That's really the point of experimenting with different approaches; they use them to get feedback, run user studies, and get a sense of what works best. > Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects log…

But `input[type="password"]` would cover the majority of login forms. At the least, it would force the con-artist have to mimic a native password box, which is more likely to get caught by the end-user.

Yes. Anything that doesn't use a password field is normally a giant hack anyway.

Re: Chrome's experiment of hiding the URL is great for security

#163

Post by dublinben »

bambax wrote: post #21
justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

> phishing is a very big problem Is it? What are the numbers? So many annoying things are done in the name of "security" without much justification (both online and in real life); Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help folks who can't be bothered to read it? Another comment suggests "source code highlighting" for the url, wh…

>where the actual domain would be emphasized while still showing the whole url

This is already the case in Firefox. I don't know how long they've been doing it, but I think it's the perfect compromise.

Re: Chrome's experiment of hiding the URL is great for security

#164

Post by pdkl95 »

edanm wrote: post #155
teacup50 wrote: post #134

Earlier quoted context omitted.

There's a rich irony in your avoidance of the most obvious car analogy possible: between internet addressing and street addressing . Understanding URLs is in no way similar to even a rudimentary understanding how an internal combustion engine works. What it's most similar is understanding how we address and route physical destinations so that you can get there in your car.

As I said in another comment: Try and explain to the average user why URLs on HN look like this: news.ycombinator.com/?id=123123 Whereas on CNN they look like this: http://edition.cnn.com/2014/05/04/world/africa/nigeria-abduc... Whereas on another news site (Israeli) they look like this: http://www.ynet.co.il/articles/0,7340,L-4516118,00.html Whereas on Reddit they look like this: http://www.reddit.com/r/pics/comment…

> Try and explain to the average user why URLs on HN look like this: > > news.ycombinator.com/?id=123123

Easy. All most people need to get out of that is the fact that there's a domain name there, and something to make each page unique. I suspect most people would also quickly recognize that each page has it's own number, similar to street addresses or the serial number found on just about everything these days.

They don't have to actually parse it as a query string. The fact that some URLs reveal a lot more information (like your CNN example) is a bonus.

> Remember: Most users barely understand, if at all, what a browser is!

Remember: 14% of adults[1] in the U.S. are illiterate.

Nobody said that we have everything solved. That doesn't mean we should give up and pretend the problem doesn't exist by saying that "most people don't need to read".

[1] http://www.statisticbrain.com/number-of-american-adults-who-... (original source: Dept. of Education)

Re: Chrome's experiment of hiding the URL is great for security

#166

Post by StuffMaster »

smsm42 wrote: post #157
pdkl95 wrote: post #111

Earlier quoted context omitted.

> Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines. There are also a surprising number of people that don't want to be literate . In the modern world, we have generally regarded such views as wrong . Basic literacy is such an important skill to have, we have even created various mandates to provide the necessary education to all children. T…

It's not literacy, it's more like knowing car's engine error codes. Arcane knowledge which is very useful if you're mechanic but would be mostly useless trivia for anybody else. Guessing "example.com/2014/04/18/the-great-quux" is a date-based URL is a nice parlor trick but most sites don't even have this URL scheme or any URL scheme at all. Next to none of the phishing-relevant sites does. No print ad would have URL…

I would liken more to like the readouts of the car. Say we hide the fuel gauge behind a menu and replace it with a "need gas" symbol. A clueless user might say "I don't want to learn how the fuel gauge or recirculating air button work. I just want to know if I need gas right now."

But knowing how to plan your trips/stops is important, as is knowing where your air is coming from.

Re: Chrome's experiment of hiding the URL is great for security

#167

Post by pcl »

justinschuh wrote: post #7

As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…

@justinschuh: what's the best way to provide feedback?

In particular, I generally like the change, but it bothers me that I need to hit the new button in order to see the URL, instead of clicking anywhere in the omnibox. I'd rather see a better-phrased version of "Search Google or interact with URL" in the omnibox, and get the whole URL on click anywhere in there. I could imagine then making a click on the button pull up the security details, just like what happens when you click the lock currently.

Also, it'd be nice if you showed the whole URL when hovering over the button.

Re: Chrome's experiment of hiding the URL is great for security

#168

Post by lugg »

baddox wrote: post #99
altcognito wrote: post #23

Earlier quoted context omitted.

So phishers buy domains with a levenshtein distance of 1 or two. It solves one problem, but creates an entire class of users that don't understand what a URL is. Who benefits? Google and search engine providers because now they can manipulate future internet users to believe that search engines are the internet. We've reverted to AOL in 1995. There is nothing more that can be productively argued about this topic. The…

There is more that can be productively argued about this topic, at least for parties who decide to not insist otherwise. URLs won't go away as long as people are still sharing websites on social networks or their own websites. I don't see the problem with not displaying the entire URL at the top of the browser window, if no actual functionality it lost. I this case, there's not even any additional clicks required to…

Came here to say similar. In addition I dont see any problem. The URL bar is a redundant usability smell. Needs to be cleaned up in the fashion they have.

On security, I feel its a problem sure, but teaching users about URLs is a bandaid fix, a hack and completely irrelevant to this change. You can't fix the phishing problem by showing URLs. It needs to be tackled in the proper manner and solved silently from the user.

Google already does the right thing when you use them for DNS (redirects on mispelt). They also implemented blacklists of dodgy content, not ideal and doesn't scale but its a good start. Better than claiming the user is at fault.

Basically if you need to claim the user is at fault your design is wrong whether you like it or not.

Re: Chrome's experiment of hiding the URL is great for security

#169

Post by dep_b »

The cynic inside me thinks that this is just a step to remove those pesky open URLs from the user and gradually push something propietary Google to replace it in the future. Google now controls about all search queries done on the web but does not control people going directly to a URL yet. That's what a big firm's marketing department would describe as a place to realize growth.

Re: Chrome's experiment of hiding the URL is great for security

#170

Post by enraged_camel »

edanm wrote: post #69

There are a number of people in this thread posting things like "the average user should be educated" and "why break things for us technically savvy people just to please people who can't be bothered to read a whole url". I really con't stand this behavior. Not everybody, not even most people, want to understand "how to web works", "how urls work" or anything else along those lines. Insisting that people are somehow…

>>I for one am very happy that the creators of automobiles have bothered to make the process so simple, even a moron at automobiles like me can drive in car and have it work 99.9% of the time, and the rest of the time - it's clear I need to take it to an expert.

On the other hand, you are required to get a driver's license before you are allowed to drive, because if you don't know the rules, you can harm yourself and other people.

Perhaps that's the direction we need to go: an Internet User's License that teaches people the basics so that they don't harm themselves and other people. They don't need to know how the Internet works to use it, but they should be expected to know how to keep themselves and others safe.

Post reply on HN