181–190 of 211 posts
AccessDenied
Access Denied
3CB1F41D7DFDC794
wHCPzEYPDsmkMJX+YIgjU40YPrGYytHrk5B44dApi7663NkQQI0RKx9A/6EX7Iph
If you want to experiment with making phishing obvious, you can play with much more obvious separations between domain and path. I see no reason why you can't use the same origin chip that's being experimented with now, but simply show the rest of the URL in the field next to the origin chip. You could even hide the URL until the user interacts with the bar, the same way iOS 7 does, except I don't think there's any good reason to do that (that's hiding potentially-useful information with no benefit [assuming that the visual distinction between domain and path is large enough, such as it is with this new origin chip]).
Earlier quoted context omitted.
I feel I'm fairly immune to traditional phishing because I never click a URL in an email. If namecheap sends me an email saying one of my domain names is about to expire, I don't use their "Renew Now" link I go to "namecheap.com" (not hard to type), log in, and renew the name. Banks and other organizations that send long complicated links in emails and encourage people to click them are part of the reason phishing is…
Yeah, part of me wonders how bad it would be / what would break if email clients banned outside links (e.g. beyond fragments in the email). My suspicion is that the only useful use of a link is a confirmation email which have other potential implementations...
As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…
My point in the last thread is that for me, personally, I edit the URL a lot. I'm writing HTML5 games. During dev I use the URL to edit/set parameters as in `http://mygame.com/numPlayers=3&ai=true&runSpeed=47`. Having the URL hidden will make it harder to edit that. Sure I can click the "show me the URL button first" it will just be annoying because I can't directly target the `47` like I can now since I won't be able to see it until after I click "show me the URL".
So, just like only devs use dev tools I'd prefer if there was a way to let me see the URL constantly. Like maybe if devtools is open the URL shows? Or maybe it's another options in dev tools just like 'disable cache if dev tools is open'? I'm sure people working with history.pushState would also like to be able to see the URL live.
Do what's best for users in general. Just please help us devs to dev too :)
Earlier quoted context omitted.
I agree that this experiment isn't demonstrating a perfect mitigation, but it's important to appreciate that it's currently vastly easier for a phisher to permute paths and subdomain components than it is to create a convincing ETLD+1. There are various reasons for this, including less text for a phisher to work with and registration requirements for ETLD+1 domains (which means they can't be iterated and dumped as qu…
What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on…
Sure sure, it's not the same thing... but it is. Why don't we just educate people to use a password manager (LastPass prevents this shit), or maybe learn to read the URL bar.
Let's not go back to 1995 AOL please. URLs are good things.
As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…
Calling this a phishing mitigation is blatantly dishonest. Hiding the URL does nothing to stop phishing. UX improvements are great, and this is clearly a UX change designed to perform great on metrics Google cares about (like search traffic), but it is not anything resembling an attack mitigation. Here are some things that actively mitigate phishing; many of them available in Chrome and actively used by many web prop…
Phishing is when an evil website tricks you into typing your bank password into it. HttpOnly cookies (as an example) are not going to do anything to prevent an evil website from looking like your bank's website.
Hide URL to make phishing harder -> URL is no longer understood by anybody ->Keyword based navigation->GoogAOL->Keyword based phising
Earlier quoted context omitted.
So phishers buy domains with a levenshtein distance of 1 or two. It solves one problem, but creates an entire class of users that don't understand what a URL is. Who benefits? Google and search engine providers because now they can manipulate future internet users to believe that search engines are the internet. We've reverted to AOL in 1995. There is nothing more that can be productively argued about this topic. The…
Good summary, basically the inter web linking will become: google:// keyword or better google keyword or even simply keyword
e.g. google.com/search?q=http%3A%2F%2Fexample.com%2Fdemo3.html
I don't even know how he generates those URLs and he didn't respond when I asked why he does it.