4 ms·

Google sees folks falling for google-secure-payments.google.via.net type URLS. They see all the gaming people do with URLs in search results (including abusing

Google sees folks falling for google-secure-payments.google.via.net type URLS. They see all the gaming people do with URLs in search results (including abusing the names of other brands like Amazon). There are lots of developers who like distinguishing these subtle topics. I can tell you in a larger enterprise deployment most of these changes will be welcomed (yes, people do still click on bogus URLs believe it or not - FAR more often than I would expect). Or think that the url amazon.lowprice.com is an amazon website in a search result. Folks claiming google is hiding the owner of the website forget that the actual owner of the website is reflected by the END of the domain name, not the earlier parts. In some shared hosting situations this is confusing, but in the end whoever controls the end actually is in control.

ljoshua 7y ago
I'm wondering how the particular address bar change helps alleviate this though. As I've seen it implemented, the only subdomain they'll "elide" is www, so if it is google-secure-payments.google.via.net it will still show as such in the address bar, not as via.net. So I don't understand their reasoning in how this will help from a security standpoint.
danShumway 7y ago
> google-secure-payments.google.via.net How does hiding www help with that? It seems to me that a decent scheme to make the domain-owner more visible would be to separate out the domain and display it separately from the entire URL, the way that Safari does. I'm not a fan of Safari's changes, but at least its easy for me to see how they could improve security -- it's a decision with real benefits, and the only question is whether they outweigh the downsides. But it's difficult for me to imagine a phishing scenario where hiding `www` will make things better. The only scenario I can think of (where `www` redirects to a different site) is made worse by hiding it from the URL.
Rychard 7y ago
> Folks claiming google is hiding the owner of the website forget that the actual owner of the website is reflected by the END of the domain name, not the earlier parts. Perhaps this distinction could be made more clear by switching to reverse domain name notation.
- klntsky 7y ago
  There are lots of security manuals for beginners suggesting to look at the ends of URLs. Imagine the amount of confusion it will introduce.
yrro 7y ago
Why don't they display such URLs as: via.net -> google -> secure-payments / whatever/whatever.html I mean, I'd hate it, but at least it puts the public suffix up front and centre^Wleft. And it doesn't hide and part of the URL from the user, it just mangles it (but in a way that arguably enhances the user's ability to understand WTF they're looking at).
dwild 7y ago
Can you tell me what's more secure and why? Before the change: www.google.com After the change: google.com Before the change: google-secure-payments.google.via.net After the change: google-secure-payments.google.via.net Seems to me like the same trick is available. Now do it like Firefox: Grey: www Black google.com Grey: google-secure-payments.google Black: via.net Warning: Check the black portion of the URL and make sure it's the right one!

ljoshua 7y ago

I'm wondering how the particular address bar change helps alleviate this though. As I've seen it implemented, the only subdomain they'll "elide" is www, so if it is google-secure-payments.google.via.net it will still show as such in the address bar, not as via.net. So I don't understand their reasoning in how this will help from a security standpoint.

danShumway 7y ago

> google-secure-payments.google.via.net How does hiding www help with that? It seems to me that a decent scheme to make the domain-owner more visible would be to separate out the domain and display it separately from the entire URL, the way that Safari does. I'm not a fan of Safari's changes, but at least its easy for me to see how they could improve security -- it's a decision with real benefits, and the only question is whether they outweigh the downsides. But it's difficult for me to imagine a phishing scenario where hiding `www` will make things better. The only scenario I can think of (where `www` redirects to a different site) is made worse by hiding it from the URL.

Rychard 7y ago

> Folks claiming google is hiding the owner of the website forget that the actual owner of the website is reflected by the END of the domain name, not the earlier parts. Perhaps this distinction could be made more clear by switching to reverse domain name notation.

klntsky 7y ago
There are lots of security manuals for beginners suggesting to look at the ends of URLs. Imagine the amount of confusion it will introduce.

yrro 7y ago

Why don't they display such URLs as: via.net -> google -> secure-payments / whatever/whatever.html I mean, I'd hate it, but at least it puts the public suffix up front and centre^Wleft. And it doesn't hide and part of the URL from the user, it just mangles it (but in a way that arguably enhances the user's ability to understand WTF they're looking at).

dwild 7y ago

Can you tell me what's more secure and why? Before the change: www.google.com After the change: google.com Before the change: google-secure-payments.google.via.net After the change: google-secure-payments.google.via.net Seems to me like the same trick is available. Now do it like Firefox: Grey: www Black google.com Grey: google-secure-payments.google Black: via.net Warning: Check the black portion of the URL and make sure it's the right one!