4 ms·

Its all fine until you have to explain to your loved ones how to read domains and the difference between an email link with random-server-name.paypal.com vs. ww

Its all fine until you have to explain to your loved ones how to read domains and the difference between an email link with random-server-name.paypal.com vs. www.paypal.random-name.com If we remove meta data like this from everyday browsing maybe it will be harder for people to even grasp the idea of how domain names work?

keymone 7y ago
domain name is not metadata and the problem you're describing is more with mail clients and html emails than anybody else.
onion2k 7y ago
Telling people to look for https:// https:// as a way to indicate that they're secure isn't good enough. There's nothing stopping a malicious party applying an SSL certificate to www.paypal.random-name.com. Browsers need to inform users based on actual information that they have (eg the SSL cert, reports of malicious domains, etc) and display that to the user. Essentially Google know more about the state of a website than a user can learn from the domain alone, and they should display that to the user. Once that's happening the various parts of the domain are less important. The downside of this is that it increases Chrome users reliance on Google.
- cm2187 7y ago
  So basically a brave new word where google will decide what is a good and a bad website. Great.
  - onion2k 7y ago
    My preferred solution would be an open API standard that companies could use to provide independent information about domains, that browsers could use to pull data about domains, and that companies who index the web could use to update whether or not they trust domains. That way anyone could set up as a source of information about whether or not a domain is trustworthy. I'm not in a position to actually do it though, and Google are (for themselves, without sharing the API), so for now that's the best we've got. Maybe someone who has the resources to compete with Google will step up.
    - chii 7y ago
      > open API standard that companies could use to provide independent information about domains ... anyone could set up as a source of information about whether or not a domain is trustworthy. and how is a user supposed to know who to trust for this information, if there are multiple sources? At the root, the problem is one of verification - that who you are communicating with is who they claim to be. At some level, there needs to be trust in one entity as a definitive source (that the site you're looking at is indeed created by the business that the site is claiming to be representing). There has to be some level of trust somewhere...
      - onion2k 7y ago
        and how is a user supposed to know who to trust for this information, if there are multiple sources? They could choose the provider they trust most. Which, for the majority, would probably be Google.
  - drivingmenuts 7y ago
    We're already there - what we really need is for Google to back the hell off some of their gatekeeping decisions.
  - amfsn 7y ago
    That's what they wanted when they pushed Let's Encrypt. https meant something before, since a certificate was expensive and required proof of identity. Yes, those methods weren't infallible, but they were good enough. Now we've lost that with free https.
    - cm2187 7y ago
      EV certs required that. DV certs never provided that sort of security.
      - amfsn 7y ago
        Of course they did. When you paid with your card they knew your identity. Unless you were carding which is a pretty serious crime.
        logifail 7y ago
        > When you paid with your card they knew your identity. Who's the "they" in that sentence? As it stands, a certificate reseller knows that the Paypal account "some.name.here@gmail.com" paid for a SSL certificate for "www.unrelatedcompany.TLD" The certificate itself tells you nothing about who paid for it - it doesn't even tell you which email account was used to confirm some level of association with the unrelatedcompany.TLD domain.
        amfsn 7y ago
        Then PayPal has the data and LE can follow the trail. Because it's about LE being able to tell who actually bought the certificate, telling me end users can't do that is kinda moving the goalposts.
        pilsetnieks 7y ago
        There are certificate authorities all over the world, and many of them not in jurisdictions that would share data with your law enforcement.
- deleted 7y ago
  [deleted]
- notahacker 7y ago
  Telling users to carefully type https://www.paypal.com https://www.paypal.com is somewhat less user friendly but a lot less phisher friendly than the "just type the company name, the other bits don't matter and the browser will find the right site for you and tell you it's secure" pattern. Paypal has good SEO, but not every shopping cart does, and its not like Google are manually vetting the content like AOL keywords did...
creshal 7y ago
Google doesn't want you to know that, Google wants you to rely on GMail to get rid of all emails Google doesn't want you to read, and rely on the Google Safe Browsing Database to decide what websites are in Google's interest for you to view. Knowing domains is also harmful to Google, you're supposed to trust Google's search to find websites (and helpful advertisements for competing sites that bribe Google better, now that they neutered adblockers).
vntok 7y ago
Well your example issue would precisely be solved by only displaying the domain name to users. Paypal.com vs random-Name.com: much easier to distinguish.
- masswerk 7y ago
  However, even in this particular edge case, why hide that there's a prefix (while you, the browser vendor, were able to put up some kind of indication for this with ease)? Generally, highlight, but don't conceal.
Avamander 7y ago
It's already hard to explain what an URL is and what they mean, 99.9999% of people using the internet do not already grasp how domain names work and unfortunately or fortunately this time the tech-savy 0.0001% lost.

keymone 7y ago

domain name is not metadata and the problem you're describing is more with mail clients and html emails than anybody else.

onion2k 7y ago

Telling people to look for https:// https:// as a way to indicate that they're secure isn't good enough. There's nothing stopping a malicious party applying an SSL certificate to www.paypal.random-name.com. Browsers need to inform users based on actual information that they have (eg the SSL cert, reports of malicious domains, etc) and display that to the user. Essentially Google know more about the state of a website than a user can learn from the domain alone, and they should display that to the user. Once that's happening the various parts of the domain are less important. The downside of this is that it increases Chrome users reliance on Google.

cm2187 7y ago
So basically a brave new word where google will decide what is a good and a bad website. Great.
- onion2k 7y ago
  My preferred solution would be an open API standard that companies could use to provide independent information about domains, that browsers could use to pull data about domains, and that companies who index the web could use to update whether or not they trust domains. That way anyone could set up as a source of information about whether or not a domain is trustworthy. I'm not in a position to actually do it though, and Google are (for themselves, without sharing the API), so for now that's the best we've got. Maybe someone who has the resources to compete with Google will step up.
  - chii 7y ago
    > open API standard that companies could use to provide independent information about domains ... anyone could set up as a source of information about whether or not a domain is trustworthy. and how is a user supposed to know who to trust for this information, if there are multiple sources? At the root, the problem is one of verification - that who you are communicating with is who they claim to be. At some level, there needs to be trust in one entity as a definitive source (that the site you're looking at is indeed created by the business that the site is claiming to be representing). There has to be some level of trust somewhere...
    - onion2k 7y ago
      and how is a user supposed to know who to trust for this information, if there are multiple sources? They could choose the provider they trust most. Which, for the majority, would probably be Google.
- drivingmenuts 7y ago
  We're already there - what we really need is for Google to back the hell off some of their gatekeeping decisions.
- amfsn 7y ago
  That's what they wanted when they pushed Let's Encrypt. https meant something before, since a certificate was expensive and required proof of identity. Yes, those methods weren't infallible, but they were good enough. Now we've lost that with free https.
  - cm2187 7y ago
    EV certs required that. DV certs never provided that sort of security.
    - amfsn 7y ago
      Of course they did. When you paid with your card they knew your identity. Unless you were carding which is a pretty serious crime.
      - logifail 7y ago
        > When you paid with your card they knew your identity. Who's the "they" in that sentence? As it stands, a certificate reseller knows that the Paypal account "some.name.here@gmail.com" paid for a SSL certificate for "www.unrelatedcompany.TLD" The certificate itself tells you nothing about who paid for it - it doesn't even tell you which email account was used to confirm some level of association with the unrelatedcompany.TLD domain.
        amfsn 7y ago
        Then PayPal has the data and LE can follow the trail. Because it's about LE being able to tell who actually bought the certificate, telling me end users can't do that is kinda moving the goalposts.
        pilsetnieks 7y ago
        There are certificate authorities all over the world, and many of them not in jurisdictions that would share data with your law enforcement.
deleted 7y ago
[deleted]
notahacker 7y ago
Telling users to carefully type https://www.paypal.com https://www.paypal.com is somewhat less user friendly but a lot less phisher friendly than the "just type the company name, the other bits don't matter and the browser will find the right site for you and tell you it's secure" pattern. Paypal has good SEO, but not every shopping cart does, and its not like Google are manually vetting the content like AOL keywords did...

creshal 7y ago

Google doesn't want you to know that, Google wants you to rely on GMail to get rid of all emails Google doesn't want you to read, and rely on the Google Safe Browsing Database to decide what websites are in Google's interest for you to view. Knowing domains is also harmful to Google, you're supposed to trust Google's search to find websites (and helpful advertisements for competing sites that bribe Google better, now that they neutered adblockers).

vntok 7y ago

Well your example issue would precisely be solved by only displaying the domain name to users. Paypal.com vs random-Name.com: much easier to distinguish.

masswerk 7y ago
However, even in this particular edge case, why hide that there's a prefix (while you, the browser vendor, were able to put up some kind of indication for this with ease)? Generally, highlight, but don't conceal.

Avamander 7y ago

It's already hard to explain what an URL is and what they mean, 99.9999% of people using the internet do not already grasp how domain names work and unfortunately or fortunately this time the tech-savy 0.0001% lost.