Obscurity is great for security. Mostly bad for everything else.
Chrome's experiment of hiding the URL is great for security
201–210 of 211 posts
Re: Chrome's experiment of hiding the URL is great for security
#202Earlier quoted context omitted.
What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on…
I really like that. Preserves all the benefits of hiding the path entirely without... hiding the path entirely. However, how would the browser tell the difference between editing the path and entering an entirely new url or search? It wouldn't be intuitive if you have to click the domain chip to go to a different site. Most of the time a user is going to click the path area in that screenshot, since that's what we're…
One solution would be that if you click any part of the url and you get fully editable text so you can change the domain or any part of the path.
Re: Chrome's experiment of hiding the URL is great for security
#203As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…
Why not, instead, show an ellipsis in place of the majority of the subdomain leading up to the domain and increase opacity of the domain compared to subdomains and the pathname.
This is similar to what happens when the path is too long for the omnibox, but simply the effect of putting the domain as far left (in the omnibox) as possible.
i.e. instead of seeing:
[ www.mybank.com.credicards.wt3_segment_secure.login.html.evil-site.com ]
You see:
[ ...html.evil-site.com/ ] (where "...html." are semi-opaque).
I mocked up what I'm suggesting here: http://remysharp.com/2014/05/04/on-chrome-hiding-urls-to-pro...
Re: Chrome's experiment of hiding the URL is great for security
#204Earlier quoted context omitted.
What is the popup you're encountering? Because it sounds like a bug, and I'd like to make sure someone is working on fixing it (or has already done so).
The popup that urges me to disable the extensions I am developing: http://i.imgur.com/4tBDrVw.png I just tried to reproduce it, and it doesn't seem to actually happen for every new window I open, so I am not sure what I am doing to trigger it, but I do encounter it several times a day. edit: Incognito seems to do it, which makes sense because I often enter/leave incognito to make sure I have a fresh cache & no cookie…
If you use the dev channel, they no longer show this popup (or color the extension icon orange).
Re: Chrome's experiment of hiding the URL is great for security
#205The path to hell is paved with good intentions. Hide URL to make phishing harder -> URL is no longer understood by anybody ->Keyword based navigation->GoogAOL->Keyword based phising
Ahh, but keyword-based phishing is profitable to the people who own the association-engine...
Re: Chrome's experiment of hiding the URL is great for security
#206Earlier quoted context omitted.
The popup that urges me to disable the extensions I am developing: http://i.imgur.com/4tBDrVw.png I just tried to reproduce it, and it doesn't seem to actually happen for every new window I open, so I am not sure what I am doing to trigger it, but I do encounter it several times a day. edit: Incognito seems to do it, which makes sense because I often enter/leave incognito to make sure I have a fresh cache & no cookie…
If you use the dev channel, they no longer show this popup (or color the extension icon orange).
How common are usability bugs in the dev channel?
Re: Chrome's experiment of hiding the URL is great for security
#207Earlier quoted context omitted.
In Chrome the domain is black and the path is grey. You could make one red and the other green and that would be actual contrast. Or give the domain a background and border. There's more ways to contrast things than adjusting the lightness of black.
More contrast might be good, but I'd not take it in expense of ugliness.
Why does it need to be ugly? I'm not a designer, but I have a hard time believing that the only way to contrast two elements without making it ugly is by having them be a slightly different shade of the same color.
Re: Chrome's experiment of hiding the URL is great for security
#208Earlier quoted context omitted.
I think grandparent's point was that the part after the domain serves simply as identification of the information that is requested from the domain. Just like the foo in foo@bar.com identifies the user at that email domain. The user doesn't need to understand the particular implementation of the identification, just the principle "same string, same page". This is important to understand that URLs can be copied and us…
I agree with the first point, but it breaks down for me when you suggest that the principle of "internet literacy" is more important than making things easier to use for the user. I would not want the people building my car to have never invented the automatic gear, because they decided somehow that it removes me from understanding how a car works.
The difference is that understanding what a gear is is not essential to the functioning of a car at all. You can completely remove it without loss for that particular user nor for the community of car users.
Whereas not knowing that a URL is a piece of text which specifies a particular content on a domain and can thus be copied and used for linking is a loss both for the user and for the community.
You'll have to reinvent the principle of linking in another form to avoid the loss (e.g. every web and local app would need special GUI functionality to use instead, and the need for specification what to link would not be completely removable, unlike the gear).
Re: Chrome's experiment of hiding the URL is great for security
#209As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…
So what I'd like to see eventually is some sort of indicator about the SSL chain itself.
I've put together a quick repo to PoC an idea that maps a chain to an html color, but I have no idea where to incorporate it into a UI.
https://github.com/Fitblip/Fingerpaint
Ideas?
Re: Chrome's experiment of hiding the URL is great for security
#210As a member of the Chrome security team and one of the original instigators for this experiment, yes the whole point is to prevent phishing. The fact is that phishing is one of the most common attack vectors for most people, and the way the URL is currently displayed does very little to protect them. So, we're experimenting with ways of displaying the essential information (origin and TLS state) as clearly as possibl…
So phishers buy domains with a levenshtein distance of 1 or two. It solves one problem, but creates an entire class of users that don't understand what a URL is. Who benefits? Google and search engine providers because now they can manipulate future internet users to believe that search engines are the internet. We've reverted to AOL in 1995. There is nothing more that can be productively argued about this topic. The…
>There is nothing more that can be productively argued about this topic.
Is that ever a good thing to say?
The change is good. I never saw any mention of people disliking this in Mobile Safari, and it's an option power users will turn off. There's plenty of them already.