9 ms·
This is idiotic and harmful. We already lost information about the protocol, because somebody believed it is "too complex" for users. Now we're losing other par
by jwr 8y ago
This is idiotic and harmful. We already lost information about the protocol, because somebody believed it is "too complex" for users. Now we're losing other parts of the URL. It's making a joke of the SSL/TLS padlock, too — what exactly is the padlock supposed to tell me? It used to signify that a "known authority" certified that I'm connected to whatever I see in the URL bar. But now that browsers take liberties with modifying the URL bar as they see fit, it becomes increasingly meaningless.
- devoply 8y agoGoogle wants to destroy the URL so the only way to find something will be via Google... They also want to tie your identity to each webpage that you author via a certificate so that all governments can clamp down on fake information or have the opportunity to in the future.
- RadioactiveMan 8y agoThe padlock was already meaningless.
- hjfa0j 8y agoIt started being meaningless thanks to Let's Encrypt. Before it meant you had to show your ID and banking info to a "reputable" corporation for them to make a cert for you. Yes I know I know, not always the case, but... LE means that the mantra "if it's https then it's a secure and reputable website" is now outdated.
- detaro 8y ago> Before it meant you had to show your ID and banking info to a "reputable" corporation for them to make a cert for you. No it didn't. Let's Encrypt made free certificates easier to get, but Let's Encrypt doesn't do less verification than some other CAs/some of their products.
- dragonwriter 8y ago> Before it meant you had to show your ID and banking info to a "reputable" corporation for them to make a cert for you. No, it didn't. DV certs never meant that (EV certs did and still do, but LE doesn't offer EV and EV isn't and never was necessary for the padlock.)
- hnbroseph 8y agoare you that Comodo guy?
- jwr 8y agoNo, the padlock means that you are likely connected to the website that the URL bar shows you. This is useful and should not be discarded because of condescending ideas about "average users". It also has the advantage of being easy to explain. Some people assign additional meaning to the padlock, which should not be done. It doesn't mean you are talking to your bank, it only means that you are talking to the website shown in the URL bar and that reasonable (simple) checks were performed to make sure that is the case. I'd suggest we invent something better before we start breaking it.
- ancarda 8y agoGiven the adoption rate of SSL, I imagine the padlock itself will become useless even without Chrome's changes. Does it mean anything if almost every website has it?
- nyolfen 8y agoideally it means no passive snooping
- tialaramex 8y agoThe clearly announced intent of at least Mozilla and Google (and I'd assume Apple and Microsoft but I don't pay as much attention) is to focus on highlighting the insecure state because that has much better security UX. Labeling one site you visit today "Not Secure" stands out. With luck it might be enough that you don't type in your credit card details.
- CydeWeys 8y agoThat's why Chrome is moving away from showing the padlock to displaying "Not secure" for sites that aren't secure. The padlock will be going away entirely; secure is the default state.
- soared 8y ago99.9% of users have no idea what any of the words you just said mean. The change was made for them, not for you (the .1%)
- tinus_hn 8y agoSo they can be hacked in serene bliss. A stupid decision.
- dagenix 8y agoHacked how?
- macspoofing 8y ago>The change was made for them, not for you Except, those same users also don't care about things in the address bar. So the change hurts the group of users that actually do care.
- ehsankia 8y agoThey didn't care so far because it was so confusing. The hope is that by showing something that's user-relevant (the name of the website name and the security level), it will become more useful for the average user. Why should a user see: https://www.wikipedia.org/wiki/Canada?utm=asdioasd&arg=j210dj9102d12 https://www.wikipedia.org/wiki/Canada?utm=asdioasd&arg=j210d... when all they care about is "Wikipedia.org/wiki/Canada"?
- geofft 8y ago> It's making a joke of the SSL/TLS padlock, too — what exactly is the padlock supposed to tell me That's why they're getting rid of it. https://blog.chromium.org/2018/05/evolving-chromes-security-indicators.html https://blog.chromium.org/2018/05/evolving-chromes-security-...
- nofunsir 8y agoThe team that implemented this change, also talk about how women confuse the padlock with an icon of a purse... https://www.wired.com/2016/11/googles-chrome-hackers-flip-webs-security-model/ https://www.wired.com/2016/11/googles-chrome-hackers-flip-we...
- download13 8y agoYou can still click and see the whole URL. This is just making it easier for the average user to see the most important thing to them, which is the domain name. It's not like they're just changing stuff randomly. The TLS padlock change has been going on for a while now, and not without reason. As we get to a point where almost everything is served over TLS it doesn't make sense to tell the user every time. It makes more sense to only notify them of the exceptional situation where we're on an insecure connection. The certificate authority system is terrible, but it's what we have for now. There's been some advances to help make it better though. CT for example, ensures that if anyone starts making fake certs we can all see it at least. I suspect (and hope) that browsers will slowly transition to using trusted spotters to verify certificates in addition to (and eventually instead of) authorities. If you remember a few years back when moxie marlinspike made that promising, but underspecified cert verification system that relied on the user supplying a list of trusted verifiers and the browser basically goes to each of them asking "I see cert 88:A4:etc" for domain "google.com", do you see the same thing? The idea was to make it really hard to MITM someone since you'd also have to MITM every verifier the browser asked. Not impossible, but probably harder than getting a fake cert under our current system.
- dfabulich 8y agoClicking doesn't reveal the URL. You have to click and use the left arrow key, at which point the protocol and www prefix appear. Just like when Chrome hid the protocol part of the URL, you can even click in the URL bar and copy it without seeing the protocol (or, now, www prefix) at all. I think it results in a confusing experience when you paste it. (Ordinary users will say: "I copied example.com but I pasted https://www.example.com https://www.example.com … why??)
- stephenc_c_ 8y agoOr double-click - basically get into the editing mode of the URL bar.
- tazard 8y agoWhat other mode would I be trying to access?
- nimrod0 8y agoIt's a sign that the Chrome team is too large and should be assigned more meaningful work.
- drb91 8y agoHow do you verify the authority owns the content? For instance: AMP urls serve content from a different authority than the one that produces the content.