Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google resumes its attack on the URL bar, hides full addresses on Chrome 86

androidpolice.com

Post reply on HN
Print view View original

211–220 of 497 posts

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#211

Post by UncleMeat »

oneeyedpigeon wrote: post #82
SifJar wrote: post #37

Earlier quoted context omitted.

I think the justification is that some people will think the website is legitimate if a legit hostname appears anywhere in the URL e.g. http://scamsite.com/microsoft.com/phish "looks" legit because it contains the string "microsoft.com" (and most "regular" users won't appreciate the different parts of a URL); under the new scheme, that would display only as "scamsite.com" and hopefully people are less likely to enter…

I think microsoft.scamsite.com would fool most of the people that scamsite.com/microsoft would. It's a very difficult problem. Can't we have something like certificates for domains, so we can at least trust the most potentially vulnerable cases?

One could hide the subdomain too (yes, I know there are cases where you have a different trust relationship depending on subdomain - but these are rare).

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#212

Post by mav3rick »

CptCrunch wrote: post #206
donor20 wrote: post #68

Wow - top posts are conspiracy theories. "The only reason to do this..." "This is a security issue..." Google has millions / billions of users. From a security standpoint the focus should be entirely on the root domain, that is the only really meaningful root of trust. If you are talking about a security issue - the KEY security issue is ANY lack of clarity around root domain. "Showing the full URL may detract from t…

Google has not only become dominant because their product is good. First and foremost, they leveraged their market power through android and their search engine to get people to use chrome.

Lol ? You do know Android was nascent when Chrome became dominant.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#214

Post by pgwhalen »

dmitryminkovsky wrote: post #169
bitexploder wrote: post #49

Earlier quoted context omitted.

We are going back to AOL days. That didn’t work out so well for AOL in the long run. It’s kind of crazy to me you can’t do marketing now without at least discussing Google and Facebook these days. Edit: at least you knew you were the customer with AOL and paid them with clear terms for access.

The only difference is that Google has endlessly more clout and depth than AOL and my fear is that where AOL failed, Google may succeed. With Firefox succumbing this week, this is pretty horrible. I’m not a Richard Stallman type, but I think it’s come to the point where if you have even the slightest pretense of being a “free web” person, using Chrome or a Chromium-based browser has become unconscionable. This compan…

> I’m not a Richard Stallman type, but I think it’s come to the point where if you have even the slightest pretense of being a “free web” person, using Chrome or a Chromium-based browser has become unconscionable.

Thanks for phrasing it like this - I'm also not a Richard Stallman type but it's hard to disagree with this statement. Just downloaded Firefox and made the switch.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#215

Post by kmeisthax »

smlckz wrote: post #152
kergonath wrote: post #51

Earlier quoted context omitted.

The premise “browsers are as powerful as OSes” is dubious. “Why do you need OSes” is something I would expect from someone who does not know how a computer works. Whilst they should probably be tweaked, address bars are central to the web as it is currently. Google should stay as far as possible from me and has no business telling me it approves of the sites I am browsing. I did not downvote the post, but there is no…

Now you know about web. Many (all?) people here (reading this shit) know. If you hear about what they are into, they are trying to get ''the next billion'' people into Their hands. Most of this ''next billion'' people don't have the time and/or courage to learn anything. They want to get their job done. (They will learn if they're forced to.) What these big companies are trying to do is very clear. They don't want th…

"The next billion" was a codename for "gaining access to Chinese markets", not "fooling tech-illiterate people into becoming Google loyalists".

The reason why the address bar is being tweaked in this manner isn't to hide the Internet from Internet users, it's to hide insecure parts of the URL. Only the domain name portion of a URL is actually secured by anything, and only the part closest to the right of the domain. Most people don't know or care that they need to run a set of regular expressions in their head and consult with a list of public suffixes to validate if a website is legitimate. They're just told, "Look for microsoft.com in the URL", and then they see http://123.45.67.89/~spam/microsoft.com/techsupport and think "Well, it says Microsoft, that means it's Microsoft".

It's not so much that Google doesn't want people knowing about the web, it's that people already don't know much about the web. It's not the people's job to know all of the relevant technical standards when they just want to know if a security alert in their e-mail is an actual thing they have to worry about or a phishing scam.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#216

Post by mav3rick »

avasthe wrote: post #92
solarengineer wrote: post #43

Earlier quoted context omitted.

I wonder if Livvie Lin and other Google engineers read such HN threads. What might be their internal discussions, I wonder. How do they justify such design decisions? Are they asked by someone else to figure out how to make such wierd things happen as they just do as ordered?

"Asked by marketing" or something like that. Fucking suits spoil everything. Engineers are in general, more ethical than suits.

Yes, marketing was obsessed with the URL bar all this while.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#217

Post by ziml77 »

AnonHP wrote: post #2

I get emails from some banks with instructions to spot phishing. One of those is to look at the full URL in emails or on websites to know if it’s authentic or not. For better or worse, the URL scheme is what we have to identify websites and pages. Hiding that on larger screens doesn’t make much sense. It also hinders learning for the next generation.

Embarrassingly I let checking the URL bar give me a false sense of security and got phished for the first time just a few days ago. They put a fake URL bar into the page and made it look like a proper OAuth2 URL. (My 2nd factor saved me from giving them access since it slowed me down enough to notice some subtle oddities, but I still had to change the password since that was already submitted)

The real protection against this is making it impossible for me to send credentials to the wrong party. Normally my password manager helps with that, but I had just switched managers a couple days before and it wasn't recognizing all sites properly (likely due to the lack of a database of known equivalent URLs). If the site was using WebAuthn, there wouldn't have been any issue because the imperfect URL checks by me and the password manager would not be necessary.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#218

Post by daveed »

achn wrote: post #46
daveed wrote: post #32

Earlier quoted context omitted.

I mean, depends who you mean by people? I'm pretty happy to go to amp sites. The thing I care about is the content.

Then you've not used many AMP sites - many do not function properly and try to 'stream' the content as you scroll leading to a garbage experience and missing content.

Maybe we tend to go to different websites, but I don't know how you can make that initial statement. I use my phone to browse the internet a fair amount.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#219

Post by worble »

scott_s wrote: post #107

Something I haven't seen anyone here bring up yet: many URLs are meaningless to humans past the domain. For an example, look at the top of this page. The only semantic meaning in the URL for this post is `news.ycombinator.com`. The rest, `item?id=24156986`, is meaningless to a human. (But, of course, meaningful to HN's backend.) A lot of (most?) of the URLs on the web are not semantic . They're naked application look…

>The rest, `item?id=24156986`, is meaningless to a human

Removing Url's is throwing the baby out with the bathwater though. Take Stack Overflow for an example:

https://stackoverflow.com/questions/53302536/vue-test-utils-...

The only thing you need to actually get to the question is https://stackoverflow.com/questions/53302536, but they intentionally add an extra human readable section for laypeople.

If google actually cared about making the internet a better place, they would simply rank human readable urls higher than non-human readable ones.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#220

Post by buttersbrian »

CptCrunch wrote: post #206
donor20 wrote: post #68

Wow - top posts are conspiracy theories. "The only reason to do this..." "This is a security issue..." Google has millions / billions of users. From a security standpoint the focus should be entirely on the root domain, that is the only really meaningful root of trust. If you are talking about a security issue - the KEY security issue is ANY lack of clarity around root domain. "Showing the full URL may detract from t…

Google has not only become dominant because their product is good. First and foremost, they leveraged their market power through android and their search engine to get people to use chrome.

As another said -- chrome was dominant before Android was a player.

Firefox blew a hole in the IE wall. Then chrome came along and was more acid compliant, leaner (Ux/ui), faster, and it's approach of per-tab processes was superior to a lock-up prone Firefox, or IE.

Post reply on HN