Humans Are Bad at URLs and Fonts Don’t Matter
troyhunt.com
Humans Are Bad at URLs and Fonts Don’t Matter
1–10 of 109 posts
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#2Good discussion of the issue, but Troy needs to run his blog through a grammar/diction checker.
Something key he alluded to but didn't get into is that browsers should remember (a hash of) your history and warn you when you visit a site (like googleblog.com) that you never visited before and isn't known to be owned by the owner of a site you have visited before.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#3Good discussion of the issue, but Troy needs to run his blog through a grammar/diction checker. Something key he alluded to but didn't get into is that browsers should remember (a hash of) your history and warn you when you visit a site (like googleblog.com) that you never visited before and isn't known to be owned by the owner of a site you have visited before.
So this means you'll get a warning before going to anyone's blog for the first time?
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#4This is one of the reasons why I think it was a mistake for the web browsers to de-emphasize EV certificates.
Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing.
I fear that because of these kind of URL issues, and with the deemphasis of EV certificates which would have provided a somewhat decentralized solution, we will end up in a world where the author of the browser becomes the ultimate authority on what is a trustworthy URL. That means for most of the users, Google will be the arbiter of what is and is not a trust worthy URL.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#5The issue with solving this problem is the incentives are mostly "how can we get Google/Apple/Microsoft/Facebook users to not get phished" since they are the strongest voices in the room when this kind of thing happens, but then half the time we get solutions like "what if we pre-registered a list of 'popular' companies and flagged everything else" which of course hurts everyone that doesn't make the list. And the other half of the time you get "what if we kept a 'bad list' of websites people should't go to" and you have the constant issue of scammers staying one step ahead of these things and/or benign websites being flagged. There still doesn't seem to be a good way to have people associate their identity with a domain on the web.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#6For firefox, you can disable IDN in the urlbar with:
user_pref("network.IDN_show_punycode", true);
https://www.xn--80ak6aa92e.com/
- It relies on you to notice the URL bar after you've clicked a link. Worse, it relies on you to notice the URL bar after you've clicked a link and after the website has begun loading long enough so that firefox changes the URL to the target.
- If you're someone who does actually visit websites with punycoded domains regularly, then this conversely makes it harder for you to know you're on the right domain.
- Even if you notice the URL is wrong, you've already started loading the page. Best case your IP is now known to that server. Worst case it had a malicious payload for your browser / OS / hardware and your content blocker wasn't configured / able to block it.
It's good enough for me, at any rate.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#7Good discussion of the issue, but Troy needs to run his blog through a grammar/diction checker. Something key he alluded to but didn't get into is that browsers should remember (a hash of) your history and warn you when you visit a site (like googleblog.com) that you never visited before and isn't known to be owned by the owner of a site you have visited before.
So this means you'll get a warning before going to anyone's blog for the first time?
Perhaps when submitting a password on a domain you've never been on before? I think that'd be super useful, actually.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#8The issue with solving this problem is the incentives are mostly "how can we get Google/Apple/Microsoft/Facebook users to not get phished" since they are the strongest voices in the room when this kind of thing happens, but then half the time we get solutions like "what if we pre-registered a list of 'popular' companies and flagged everything else" which of course hurts everyone that doesn't make the list. And the ot…
Just like in real life, I think the answer is not prevention but accountability. The only thing stopping a random person from bashing in my head on the sidewalk (besides moral decency) is their understanding of the consequences. They can do it, but they'll go to jail for a long, long time.
Similarly, the answer on the net is not to stop bad actors from being bad. It's to punish and hold accountable those that do bad things. That avoids the "thoughtcrime" problem, and makes space for actual freedom.
The only thing we have to lose is privacy for domain owners. Seems like a trade-off worth considering.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#9For firefox, you can disable IDN in the urlbar with: user_pref("network.IDN_show_punycode", true); in your user.js. Then all URLs will appear in their punycode form, eg apple.com with the cyrillic glyphs will show as: https://www.xn--80ak6aa92e.com/ Is this good enough? Probably not in general. - It relies on you to notice the URL bar after you've clicked a link. Worse, it relies on you to notice the URL bar after yo…
Sadly, this solution makes the situation worse for people who browse sites that aren't trying to run IDN spoofing because punycode URLs all look the same.
Re: Humans Are Bad at URLs and Fonts Don’t Matter
#10This is one of the reasons why I think it was a mistake for the web browsers to de-emphasize EV certificates. Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing. I fear that because of these kind of URL issues, and with the deemphasis of EV certificates which would have provided a somewhat decentralized solution, we will end up in a world where…
Even better: Rather than all the red-tape, you can just use an indicator between `$` and `$$$$$` to indicate how much the subject paid for the certificate. This is better because it establishes more than just two (five!) tiers of credibility. I briefly considered adding a sixth tier, but I think that would be distasteful.