Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google resumes its attack on the URL bar, hides full addresses on Chrome 86

androidpolice.com

Post reply on HN
Print view View original

371–380 of 497 posts

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#371

Post by Jach »

bambax wrote: post #205
walrus01 wrote: post #86

Earlier quoted context omitted.

I encourage everyone to use Firefox on Android just for the one killer feature of being able to install the full desktop ublock origin plugin.

Yes!! When I see other people browsing on Android without uBlock I'm in awe of their patience.

With Blockada, you can block lots of stuff at the DNS level, so it's more tolerable. But it doesn't block everything, uBlock is smarter. Still I keep it running, it's especially great for all the other apps trying to talk to ad or analytics servers. (I'd actually like to combine Blockada and NoRoot Firewall though...)

I use an old phone (until Librem ships...) and I switch back and forth between Chrome Beta and Firefox... they each piss me off. Firefox is slow, I've tried the newer fenix system and it's not really better, plus it crashes a lot. Especially on sites like mobile twitter, probably in part because of the overhead of uBlock having to fix up the DOM; essentially the crash is a failure in handling a system out of memory error in a low level part of the graphics stack that mobile chrome had a long time ago too but managed to fix years ago. Recently chrome pissed me off more because when I tried to take a screenshot of a tweet with a funny google translation, chrome+android colluded to block it because of some issue like "the display contains protected DRM content." Firefox, no issue, apart from crashing 10 minutes later. At least I haven't lost my tabs to a Firefox crash (mobile or PC) for many, many years.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#372

Post by themacguffinman »

Liquix wrote: post #50
tyingq wrote: post #36

Earlier quoted context omitted.

Trying hard not to sound like a conspiracy theorist. However, it's pretty obvious this benefits a walled garden strategy. With things like AMP, "rich snippets", etc, they keep eyeballs on Google owned properties longer. Slowly deprecating urls over time makes it less visually apparent. AOL was able to sell "keywords" this way, because it wasn't always obvious to their users how to get to the real internet.

It's not a wacky far-out conspiracy theory to notice that Google is attempting to dominate the internet. It's a serious problem that we need to do something about before it's too late.

It is, however, a wacky far-out conspiracy theory to claim that Google is developing this feature for the purpose of internet domination.

The given purpose is phishing prevention, which is the same reason why this exact feature has been part of Safari for years yet no one pointed out that it was a nefarious attempt by Apple to takeover the web and further their walled garden.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#373

Post by tialaramex »

judge2020 wrote: post #146
oneeyedpigeon wrote: post #82

Earlier quoted context omitted.

I think microsoft.scamsite.com would fool most of the people that scamsite.com/microsoft would. It's a very difficult problem. Can't we have something like certificates for domains, so we can at least trust the most potentially vulnerable cases?

If EV certificates were good they'd be great for showing alongside the URL, but they're both expensive for most (used to be $100/yr if you go for the cheapest vendor, now heavily discounted since the URL bar change made it lose value) and the legal entity verification doesn't work in a sense that company names aren't unique[0]. 0: https://news.ycombinator.com/item?id=15904513

They (EV certificates) also don't do as much as you probably think they do. Or, I suppose, seen from a different angle, the actual dnsName matching does a lot more than you realise.

When you visit news.ycombinator.com obviously the browser confirms that the certificate presented is for news.ycombinator.com and not anything else. Because the machine does dnsName matches and machines are fast, it happens prior to every single transaction as necessary. In contrast EV information like company name can only be checked by a human, slowly, after a transaction already completed.

Suppose I hit this "reply" button to post this, but bad guys have just at that moment intercepted my network connection. The browser connects to news.ycombinator.com and... their certificate either isn't trustworthy or isn't for news.ycombinator.com and so this text is never sent to the bad guys at all.

But EV certificate details are only useful retrospectively. The browser can tell me after the fact that it posted the response to "Phishing Corp. Ha Ha Ha We've Got Your Data Now" but it doesn't actually know that's the wrong place so it won't abort the transaction.

For this and other reasons the entire EV design doesn't really "work" from a security point of view, and wasn't ever really intended to. It's a marketing idea, not a security idea.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#374

Post by andrekandre »

untog wrote: post #277
izacus wrote: post #194

Earlier quoted context omitted.

The strange part there is that this is mobile Chrome following the mobile Safari UX which has never been criticised like this. It's just bizarre.

Even desktop Safari does this by default! And yet no one was outraged.

i think its because apple isnt trying to mitm your web browsing with some amp-style service (yet)

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#376

Post by zentiggr »

yrro wrote: post #196
Beldin wrote: post #173

Earlier quoted context omitted.

I tried. Tab switching was - for me - horrible compared to Chrome (chrome:swipe down, swipe address bar down, select tab you want from carousel). I kept looking if i missed this obvious feature. I tried to live without it, but Firefox mobile's tab switching just turned out to be a deal breaker for me. If anyone had some tips: please!! I'd vastly prefer using FF on mobile.

This has been reworked in https://play.google.com/store/apps/details?id=org.mozilla.fi... . The URL bar is now at the bottom of the screen, including the tab switch button which is now always within reach of your thumb. On the other hand, I didn't have a problem with tapping the tab select button in the non-beta app, where it's in exactly the same position as it is in Chrome...

URL bar on the bottom sounds amazing :) I'm all in favor of moving all toolbars, search fields, any sort of interactive controls to the bottom on mobile interfaces. So much easier than having to reach to the top of the screen at random, even if it isn't always thumbable.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#377

Post by dgb23 »

summerlight wrote: post #369
dgb23 wrote: post #316

Earlier quoted context omitted.

The root domain is highlighted in FF. This must be enough for visual testing. If you want a more reliable approach then you need to work with a whitelist and clear warnings.

I wouldn't assert it without strong evidence. This URL comprehension problem is probably more complex than what people usually think. There are a number of studies about this issue, if you're interested. https://storage.googleapis.com/pub-tools-public-publication-... https://kumarde.com/papers/urls.pdf

Thank you for those! Side question:

I don't have a formal education in CS, but I really enjoy reading papers on programming (languages), architecture, data-engineering and web related things among others, especially when they have a practical focus/impact.

Is there a good way for me to find or rather discover resources like these?

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#378

Post by donmcronald »

oneeyedpigeon wrote: post #62
khaledh wrote: post #12

IMO this is the real reason why they're pushing hard towards this: However, it's also worth considering that making the web address less important, as this feature does, benefits Google as a company. Google's goal with Accelerated Mobile Pages (AMP) and similar technologies is to keep users on Google-hosted content as much as possible, and Chrome for Android already modifies the address bar on AMP pages to hide that…

> Chrome for Android already modifies the address bar on AMP pages How does it do this? The URL looks totally as I'd expect (google.com/amp/) - I'm on version 84.0

It's called signed exchanges.

https://amp.dev/documentation/guides-and-tutorials/optimize-...

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#379

Post by toast0 »

avasthe wrote: post #104
fareesh wrote: post #90

Earlier quoted context omitted.

Google rewards developers who use AMP with better search positioning than even a plain HTML page

Yeah. But AMP was an initiative for speeding up the web.

Almost every AMP page I went to felt slower than when I went to the real page behind it.

I think a significant portion of that was that AMP wants everything rendered in a single paint. As opposed to the typical news site which shows the article for a while, then later hides it when the javascript had time to run. Seeing an article while the page finishes loading feels a lot faster than seeing a white screen until the page finishes loading, even if the content moving around on the first one is annoying.

Re: Google resumes its attack on the URL bar, hides full addresses on Chrome 86

#380

Post by RonanTheGrey »

IX-103 wrote: post #328
nessunodoro wrote: post #207

Earlier quoted context omitted.

Google is many different companies and products, and some of them I'm so grateful for. They provide a simple product that does something magically better than the competition, don't screw with the recipe. I give them my data because I like the service. But the company-wide decision to manipulate the URL as a business strategy drains all my enthusiasm. The "U" is really important! The URL is basically a filename that…

Is it really a company-wide strategy to manipulate the URL? The Chrome change was based on user studies that showed that people do not understand URLs. The days of URLs as a data access key are gone. So many other things (cookies, etc) go into controlling what pages show that what was originally a 1:1 mapping between URL and content is now a many to many mapping. I'm not saying that's how it should be, but that's the…

Doesn't matter if they understand it or not. It's the one and only barrier between you and malicious actors, or you and a monopolist. And oh look there's Google, attacking the one thing that protects the world from their ownership of the web.

People might not understand how a seat belt works, it's still there and we still use them.

Post reply on HN