3 ms·
> Making the address bar lie is dangerous This x1000. The only positive constant users have had since 1994 is that the URL doesn't lie. You can look at it and
by sys_64738 7y ago
> Making the address bar lie is dangerous
This x1000.
The only positive constant users have had since 1994 is that the URL doesn't lie. You can look at it and figure out if you're safe or not. Now Google wants to hide that from users by this masquerading going on. That is simply terrible and doomed to be exploited in the years to come.
The only people who win here are the scammers who will defraud users.
- username444 7y agoNot entirely true: https://en.m.wikipedia.org/wiki/IDN_homograph_attack https://en.m.wikipedia.org/wiki/IDN_homograph_attack
- v7p1Qbt1im 7y agoYou can‘t really, though. Many people have been fooled by fake URL‘s. Nobody checks the cert. To say nothing of the non-human-readable token URL‘s in emails. Password managers and hardware tokens (Android phones too now) are actually a much better defense against phishing.
- ec109685 7y agoCan you explain how scamming is possible? The page shown to user is cryptographically verified to have been fetched from the url shown to the user in chrome’s url bar.
- keiru 7y agoMaybe not directly scamming exploiting this mechanism, but it might destroy the healthy habit of URL checking and being aware of what is going on. Instead people are given a false "seamless" experience. In the future similar white lies might be adopted by other companies, and eventually exploited. Just like the endless bombardment of cookies warnings trained people to just click through "OK"s and "Accept"s. Paired with introduction of the new Google portals, people might get used to opening a site within a site, or a site that is not the site. Now you can scam people by making them believe your shady website has a seamless Paypal/Visa portal, but it's just a css copycat and a private database of fools. I don't know why I'm always weary of increased levels of abstraction in interfaces.