3 ms·
> security-sensitive surfaces like the omnibox. Yes. It’s security sensitive. Any incorrect or misleading information placed here can trick a user proceeding w
by josteink 7y ago
> security-sensitive surfaces like the omnibox.
Yes. It’s security sensitive. Any incorrect or misleading information placed here can trick a user proceeding with actions they otherwise would not.
So we should let the URL-bar present the unmangled URL and nothing else.
- UncleMeat 7y agoThe "security sensitive" information in the URL bar is horrible. For TLS you need to look for the presence of a single character. For most people, "http://" http://" and "https://" https://" are both gibberish and remembering which one is good is not obvious. For domain names you now need to look past all of the subdomains since mybank.evil.com isn't safe. But don't look all the way to the right since that is usually full of gibberish and everything after the "/" isn't trustworthy either. Oh and watch out for homoglyphs too. URLs suck for security. Also I bet you are upset that port numbers aren't included in the displayed URL too.
- Dylan16807 7y agoYou need to justify that "So". Showing all the info you have is often less clear than showing the most important parts. Showing the info you have in an unsorted blob is often less clear than having separate fields/fonts. (Read "less clear" as a synonym for "misleading".) Imagine if the URL bar showed the full set of HTTP headers instead. That's more information, and it's more accurate and less mangled than showing just the URL. But it's a much worse interface and harder to use securely.