Since when is an arbitrary cross-origin domain name a valid user interface choice? From a security standpoint, using the _path_ of a trusted domain is still a

Since when is an arbitrary cross-origin domain name a valid user interface choice? From a security standpoint, using the _path_ of a trusted domain is still a thousand times more secure and convenient, rather than navigating to another arbitrary domain name with no validation of whether it is affiliated with the domain where you've come from. If Google push this sort of mechanism, it's opening up a whole load of fraud capabilities! If I'm on gmail and receive a phishing attack email, tricking me into navigating to "gmail.new" which asks for my google password, should I type it into the box? There is a green padlock in the URL so it must be fine.