Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Humans Are Bad at URLs and Fonts Don’t Matter

troyhunt.com

Post reply on HN
Print view View original

21–30 of 109 posts

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#21

Post by pwinnski »

It's a hard problem, but I don't think there's any solution that doesn't make the web measurably worse.

We have consolidation and the exclusion of bit players and new entrants in real life already, and I don't like it. Now we're talking about solving these problems on the internet in a way that seems like it will lead to the same place.

I definitely don't want Google to solve this problem for me. Then again, I don't use their search engine nor primarily their browser, so then we end up with "solutions" that are very unevenly distributed.

The root issue is that the internet is a very hostile environment, and trying to make it safe seems like a losing cause, a denial of reality.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#23

Post by julienb_sea »

Arnavion wrote: post #6

For firefox, you can disable IDN in the urlbar with: user_pref("network.IDN_show_punycode", true); in your user.js. Then all URLs will appear in their punycode form, eg apple.com with the cyrillic glyphs will show as: https://www.xn--80ak6aa92e.com/ Is this good enough? Probably not in general. - It relies on you to notice the URL bar after you've clicked a link. Worse, it relies on you to notice the URL bar after yo…

In chrome for me this happened automatically with the cyrillic apple.com. However doesn't happen with any other website. Seems pretty smart.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#24

Post by anuila »

I don’t understand why you don’t want to blame the victim. My own father entered his bank password into a random site he received via SMS. The url wasn’t even similar.

The only solution to this is to tell users to look at the URL bar and make that work well. If they don’t, you can’t do much.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#25

Post by tylerhou »

lilyball wrote: post #20
Arnavion wrote: post #6

For firefox, you can disable IDN in the urlbar with: user_pref("network.IDN_show_punycode", true); in your user.js. Then all URLs will appear in their punycode form, eg apple.com with the cyrillic glyphs will show as: https://www.xn--80ak6aa92e.com/ Is this good enough? Probably not in general. - It relies on you to notice the URL bar after you've clicked a link. Worse, it relies on you to notice the URL bar after yo…

I'm honestly surprised at Firefox's behavior here. I thought all of the browsers years ago identified homoglyph attacks and deployed defenses. For example, in Safari, this domain does render as https://www.xn--80ak6aa92e.com because Safari decided this was a homoglyph attack. My impression was all the browsers did this for any domain that used a homoglyph of a latin character, so why is Firefox failing?

As far as I can recall, Firefox (and maybe Chrome) will still display the original glyphs if they are all from the same character set. So for example, all Cyrillic apple will display as apple, but apple where only the a is Cyrillic will display punycode for the a.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#27

Post by jniedrauer »

A browser-based password manager mostly solves the confusables problem. If your password manager matches by domain name, and someone tries to phish you, it will immediately clue you in that something's not right.

Unfortunately this doesn't solve the problem in general, because most people don't use password managers.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#28

Post by SamBam »

macNchz wrote: post #7
saagarjha wrote: post #3

Earlier quoted context omitted.

So this means you'll get a warning before going to anyone's blog for the first time?

Perhaps when submitting a password on a domain you've never been on before? I think that'd be super useful, actually.

On Venmo when you send money to a new person they say "This is the first time you've sent money to so-and-so" and recommend you confirm the receiver's phone number (though you can also skip it).

I think a similar warning could be fine for passwords and auto-fill information: "This is the first time you're sending a password to googie.com, which is registered to the Googie Real Estate Corporation. Is that what you mean to do?"

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#29

Post by bleepblorp »

darkerside wrote: post #8
saagarjha wrote: post #5

The issue with solving this problem is the incentives are mostly "how can we get Google/Apple/Microsoft/Facebook users to not get phished" since they are the strongest voices in the room when this kind of thing happens, but then half the time we get solutions like "what if we pre-registered a list of 'popular' companies and flagged everything else" which of course hurts everyone that doesn't make the list. And the ot…

Just like in real life, I think the answer is not prevention but accountability. The only thing stopping a random person from bashing in my head on the sidewalk (besides moral decency) is their understanding of the consequences. They can do it, but they'll go to jail for a long, long time. Similarly, the answer on the net is not to stop bad actors from being bad. It's to punish and hold accountable those that do bad…

A lot of phishing, and other online financial crime, is perpetrated by groups operating with the support of their home governments. There's no way to hold North Korean state-backed phishing/criminal hacking groups accountable without disconnecting North Korea from the Internet or going to war with them. Similar issues apply to curtailing online crime committed by Russian mafia entities, as they are well connected to the Russian government.

An alternative strategy would be to crack down on the money laundering channels used by criminal entities to get money from their victims, but this would be politically difficult as it would involve shutting down grey-market banks that are well used by the ultra wealthy to evade taxes and pay bribes.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#30

Post by julianozen »

jniedrauer wrote: post #27

A browser-based password manager mostly solves the confusables problem. If your password manager matches by domain name, and someone tries to phish you, it will immediately clue you in that something's not right. Unfortunately this doesn't solve the problem in general, because most people don't use password managers.

And I frequently need to add alternative trusted URLs to 1Password so that auto fill works on the same authentication across different domains (this I find I need often for like banks)
Post reply on HN