Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google resumes its attack on the URL bar, hides full addresses on Chrome 86

androidpolice.com

Post reply on HN
Print view View original

141–150 of 497 posts

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#141

Post by ffwd »

mkl wrote: post #3
AnonHP wrote: post #2

I get emails from some banks with instructions to spot phishing. One of those is to look at the full URL in emails or on websites to know if it’s authentic or not. For better or worse, the URL scheme is what we have to identify websites and pages. Hiding that on larger screens doesn’t make much sense. It also hinders learning for the next generation.

Actually, that's their argument for doing it. Most users don't understand the different bits of a URL, to know whether it's from the site they think it's from. See (huge) previous discussion from two months ago: https://news.ycombinator.com/item?id=23516088 Personally, for my own purposes, I think hiding any bit of the URL is incredibly inconvenient. Already hiding the www. is seriously annoying. I will switch this n…

Just fyi, the google chrome plugin "Suspicious Site Reporter" reverts the url back to how it always was, with http:// and www and everything else. It's very lightweight and you can just leave it on, don't have to report anything or do anything with it.

Hopefully it remains this way _forever_, even with these newer changes as well.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#142

Post by Wolfenstein98k »

What are they gaining from this that possesses then to fight such consistent opposition?

I don't see anyone stumping for this or any groups making any arguments for it beyond aesthetics, which is nice but surely doesn't outweigh all the vociferous opposition.

What gives? Cui bono?

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#143

Post by mroche »

Having looked at the intended design implementation, I'm not _super_ against this change, but I'm not fully onboard. And the concept of AMP here isn't lost on me, either.

I understand the stated goal of this is for simplicity for users and enhancing generic security. I feel Firefox already does this better. Let's take the following URL for example:

https://code.visualstudio.com/docs/

On my work MBP with FF 79 and GC 81, this is what I see ([] signifies contrasted text color):

Firefox: https://code.[visualstudio.com]/docs/

Chrome: [code.visualstudio.com]/docs/

Chrome (after clicking twice in the address bar: https://[code.visualstudio.com]/docs/

Chrome 86 (uses above formatting on hover): code.visualstudio.com

In both apps, the dark themes provide more contrast that the light ones. I don't think we need to hide URL's from users, because what really matters is the very beginning of the URL which is always shown, and noting the root domain in a more contrasted, apparent way (like Firefox does) is to me a better solution to this problem. Spending time to improve the appearance of the important part of the URL will help everyone in the end, rather than taking the easy road of just isolating it.

Time would be better spent on solving horrible looking URLs in the first place and how URLs get represented in sharing (e.g. email clients, SMS, etc), which is where arguable most visual URL security concerns take place. If anything, I think I'm less likely to trust a URL like this (a simple Google search for "example url") when taking a glance in an email (removed https so full URL would show):

"://www.google.com/search?source=hp&ei=IJ82X6DoINCJytMP75Cn6As&q=example+url&oq=example+url&gs_lcp=CgZwc3ktYWIQAzICCAAyAggAMgIIADICCAAyAggAMgIIADICCAAyAggAMgIIADICCAA6CAgAELEDEIMBOgUIABCxAzoCCC46CwguELEDEMcBEKMCOgUILhCxAzoECAAQCjoLCC4QsQMQxwEQrwE6CggAELEDEEYQ-QFQkDJYxEdg3khoAnAAeAGAAbsBiAHBBpIBBDEyLjGYAQCgAQGqAQdnd3Mtd2l6&sclient=psy-ab&ved=0ahUKEwig-Nis85rrAhXQhHIEHW_ICb0Q4dUDCAg&uact=5"

than "://www.google.com/search?query=example+url"

If on mobile, go into landscape for the larger URL, unless there’s a better way to format it I’m not aware of. Didn’t think a code block was best for a massive oneliner.

A possible middle ground could be taking a look at limiting token visibility. But a larger discussion would be needed for that as well.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#144

Post by MaxBarraclough »

acheron wrote: post #133
MaxBarraclough wrote: post #91

Earlier quoted context omitted.

> their focus on things like ... security ... helped them become absolutely dominant I don't think Chrome's security features had anything to do with its ascension. Chrome took off because it was fast and had a good UI (iirc it had the ability to drag a tab from one window to another, a while before other browsers did). The average user knows nothing of the security features of their browser.

Chrome took off because Google leveraged their position in another area (search engine) in order to push it. Exactly what people were concerned about with Microsoft and Windows/IE.

That's not the whole story. Plenty of people moved from Firefox to Chrome, because they found Chrome to be the better browser.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#145

Post by badwolf »

donor20 wrote: post #68

Wow - top posts are conspiracy theories. "The only reason to do this..." "This is a security issue..." Google has millions / billions of users. From a security standpoint the focus should be entirely on the root domain, that is the only really meaningful root of trust. If you are talking about a security issue - the KEY security issue is ANY lack of clarity around root domain. "Showing the full URL may detract from t…

My first thought when reading this was relief... For my mother.

I've spent most of my adult life trying to teach my parents to look at the address bar to make sure they're on bankofamerica.com and not some random phishing domain. That kind of falls apart though when it's... bankofamerica.comm.phishingdom.com/{random filler}/bankofamerica/user/login

HN users are fantastic at thinking all technologies should revolve around their niche use case.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#146

Post by judge2020 »

oneeyedpigeon wrote: post #82
SifJar wrote: post #37

Earlier quoted context omitted.

I think the justification is that some people will think the website is legitimate if a legit hostname appears anywhere in the URL e.g. http://scamsite.com/microsoft.com/phish "looks" legit because it contains the string "microsoft.com" (and most "regular" users won't appreciate the different parts of a URL); under the new scheme, that would display only as "scamsite.com" and hopefully people are less likely to enter…

I think microsoft.scamsite.com would fool most of the people that scamsite.com/microsoft would. It's a very difficult problem. Can't we have something like certificates for domains, so we can at least trust the most potentially vulnerable cases?

If EV certificates were good they'd be great for showing alongside the URL, but they're both expensive for most (used to be $100/yr if you go for the cheapest vendor, now heavily discounted since the URL bar change made it lose value) and the legal entity verification doesn't work in a sense that company names aren't unique[0].

0: https://news.ycombinator.com/item?id=15904513

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#147

Post by twirlock »

donor20 wrote: post #68

Wow - top posts are conspiracy theories. "The only reason to do this..." "This is a security issue..." Google has millions / billions of users. From a security standpoint the focus should be entirely on the root domain, that is the only really meaningful root of trust. If you are talking about a security issue - the KEY security issue is ANY lack of clarity around root domain. "Showing the full URL may detract from t…

> conspiracy theories

2007 called. They want their deflection back.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#148

Post by badwolf »

MaxBarraclough wrote: post #144
acheron wrote: post #133

Earlier quoted context omitted.

Chrome took off because Google leveraged their position in another area (search engine) in order to push it. Exactly what people were concerned about with Microsoft and Windows/IE.

That's not the whole story. Plenty of people moved from Firefox to Chrome, because they found Chrome to be the better browser.

Even Microsoft thought that with Edge.
Post reply on HN