5 ms·

This won't work for two reasons: 1) Legacy: URLs are fundamental to the way the the web is architected at too low of a level to change. We could change the br

by feral 16y ago

This won't work for two reasons: 1) Legacy: URLs are fundamental to the way the the web is architected at too low of a level to change. We could change the browser to not display them, or display something else, but trying to make a web-wide change to put the prettiness in the URL isn't going to happen. 2) Security: There are already many attacks involving using unicode strings to allow an evil website masquerade as a good one. The URL is the one way a user knows whether they are on mybank.com or evilbank.com While its not a sufficient security system, its the best we've got so far; and its taken too long to train users to this level to just throw it away. If we were starting again from scratch, bundling better navigational metadata would be worth doing - but thats just wishful thinking, and only the tip of the iceberg for what we might change.

Groxx 16y ago
>and its taken too long to train users to this level to just throw it away. Users have been trained? Since when? Though I do agree this is likely to only make things worse in that area.
- Seth_Kriticos 16y ago
  Since their bank account got raped the first time?
- feral 16y ago
  Trained in the sense that, over time, many of them have learned, or read or been told to pay attention to the URL for security reasons. They are trained by their friends, by blogs, websites, (my bank website frequently reminds me to check the URL), articles in print media, etc. Now, this doesn't mean users won't still be conned. But its important not to be blase about the worth of that accumulated knowledge. It takes a lot of time - and cases of fraud - before knowledge like "I should check the URL" filters down to the average user. This knowledge, having been thus accumulated, shouldn't be casually discarded, or undervalued, by those of us who do computers for a living. Its hard to train users to follow security procedures at the best of times, without changing the rules. Examples of what I'm talking about, from a quick Google: "look for indicators that the site is secure, like a lock icon on the browser’s status bar or a URL for a website that begins https:" http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/alt127.shtm http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/alt127.shtm "A phishing site may look exactly like the real site, but the URL will look strange." http://www.ehow.com/how_5236627_avoid-online-like-fake-paypal.html http://www.ehow.com/how_5236627_avoid-online-like-fake-paypa... http://www.microsoft.com/protect/fraud/phishing/spoof.aspx http://www.microsoft.com/protect/fraud/phishing/spoof.aspx There are a plenty of examples of similar articles.
  - Groxx 16y ago
    I know of one non-geek who spotted a strange URL and actually looked deeper. My mom, who's rapidly improving her computer skills - she noticed a login redirected to a massively different URL. Missed that it was still the same domain, but now she understands the parts of a URL better. This, from years of being the geek-as-tech-support for quite a few people. Non-geeks (ie, those who do not understand URLs to a minimum-safe degree) who even look at the URL while they browse are, in my experience, exceedingly rare. None I've even seen notice the "revoked certificate" flag, and many people browsing at school have clicked right through the phishing / scam / malware warnings to get to their game. People. Do. Not. Understand. URLs. There's no mapping to the real world, certainly no obvious mapping, and understanding how they work and what's important requires far more tech knowledge than the average person has.

by feral 16y ago

Groxx 16y ago

>and its taken too long to train users to this level to just throw it away. Users have been trained? Since when? Though I do agree this is likely to only make things worse in that area.

Seth_Kriticos 16y ago
Since their bank account got raped the first time?
feral 16y ago
Trained in the sense that, over time, many of them have learned, or read or been told to pay attention to the URL for security reasons. They are trained by their friends, by blogs, websites, (my bank website frequently reminds me to check the URL), articles in print media, etc. Now, this doesn't mean users won't still be conned. But its important not to be blase about the worth of that accumulated knowledge. It takes a lot of time - and cases of fraud - before knowledge like "I should check the URL" filters down to the average user. This knowledge, having been thus accumulated, shouldn't be casually discarded, or undervalued, by those of us who do computers for a living. Its hard to train users to follow security procedures at the best of times, without changing the rules. Examples of what I'm talking about, from a quick Google: "look for indicators that the site is secure, like a lock icon on the browser’s status bar or a URL for a website that begins https:" http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/alt127.shtm http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/alt127.shtm "A phishing site may look exactly like the real site, but the URL will look strange." http://www.ehow.com/how_5236627_avoid-online-like-fake-paypal.html http://www.ehow.com/how_5236627_avoid-online-like-fake-paypa... http://www.microsoft.com/protect/fraud/phishing/spoof.aspx http://www.microsoft.com/protect/fraud/phishing/spoof.aspx There are a plenty of examples of similar articles.
- Groxx 16y ago
  I know of one non-geek who spotted a strange URL and actually looked deeper. My mom, who's rapidly improving her computer skills - she noticed a login redirected to a massively different URL. Missed that it was still the same domain, but now she understands the parts of a URL better. This, from years of being the geek-as-tech-support for quite a few people. Non-geeks (ie, those who do not understand URLs to a minimum-safe degree) who even look at the URL while they browse are, in my experience, exceedingly rare. None I've even seen notice the "revoked certificate" flag, and many people browsing at school have clicked right through the phishing / scam / malware warnings to get to their game. People. Do. Not. Understand. URLs. There's no mapping to the real world, certainly no obvious mapping, and understanding how they work and what's important requires far more tech knowledge than the average person has.