4 ms·

Wouldn't it make more sense just to fix the URL bar to make data URIs look different? You could even go to the extreme of making it just show "data:…" and requi

Wouldn't it make more sense just to fix the URL bar to make data URIs look different? You could even go to the extreme of making it just show "data:…" and requiring you to put focus on it to find out the full URI.

userbinator 9y ago
No kidding... this is a problem they created by hiding/obfuscating the URL scheme. If the majority of URLs you visit start with http:// http:// or https:// https://, then data: stands out like the proverbial sore thumb.
- beefhash 9y ago
  That requires that you know what you're doing, though. Non-technical people are probably more inclined to think along the lines of "huh, odd, but everything looks fine, so it's probably my fault it looks like that"
  - ascorbic 9y ago
    In that case why bother with using a data url at all? They could just use "www.paypal.com.cgi-bin.webscr.xxxxxxxxx.myevilsite.com"
    - beefhash 9y ago
      That way, they don't have to bother with a domain registration, either. A domain registration is neither free of charge nor entirely free of risk.
      - code_duck 9y ago
        They could just create subdomains on a compromised domain they control belonging to someone else.
- jchw 9y ago
  Did they hide it? I see "https://" https://" in my Firefox.
  - daveFNbuck 9y ago
    They show https:// https:// but they hide http:// http://
    - jchw 9y ago
      Oh, I honestly would've missed this, because so few sites I browse are in cleartext anymore. They may as well just display a giant "INSECURE" banner, instead of http:// http://, though.
      - Vinnl 9y ago
        They will, and they already do if that page includes a password form field :)
      - johnp_ 9y ago
        FWIW, this recently landed in Firefox Nightly: security.insecure_connection_icon.enabled security.insecure_connection_icon.pbmode.enabled Though it's still disabled by default (currently the insecure connection icon is only shown if a password field is present on a http page / the form action url is http).

userbinator 9y ago

No kidding... this is a problem they created by hiding/obfuscating the URL scheme. If the majority of URLs you visit start with http:// http:// or https:// https://, then data: stands out like the proverbial sore thumb.

beefhash 9y ago
That requires that you know what you're doing, though. Non-technical people are probably more inclined to think along the lines of "huh, odd, but everything looks fine, so it's probably my fault it looks like that"
- ascorbic 9y ago
  In that case why bother with using a data url at all? They could just use "www.paypal.com.cgi-bin.webscr.xxxxxxxxx.myevilsite.com"
  - beefhash 9y ago
    That way, they don't have to bother with a domain registration, either. A domain registration is neither free of charge nor entirely free of risk.
    - code_duck 9y ago
      They could just create subdomains on a compromised domain they control belonging to someone else.
jchw 9y ago
Did they hide it? I see "https://" https://" in my Firefox.
- daveFNbuck 9y ago
  They show https:// https:// but they hide http:// http://
  - jchw 9y ago
    Oh, I honestly would've missed this, because so few sites I browse are in cleartext anymore. They may as well just display a giant "INSECURE" banner, instead of http:// http://, though.
    - Vinnl 9y ago
      They will, and they already do if that page includes a password form field :)
    - johnp_ 9y ago
      FWIW, this recently landed in Firefox Nightly: security.insecure_connection_icon.enabled security.insecure_connection_icon.pbmode.enabled Though it's still disabled by default (currently the insecure connection icon is only shown if a password field is present on a http page / the form action url is http).