4 ms·

A couple of Google Chrome devs talk about the issues surrounding the readability of urls and their security implications and possible solutions in an episode of

A couple of Google Chrome devs talk about the issues surrounding the readability of urls and their security implications and possible solutions in an episode of their podcast[0]. I think they make a compelling argument for hiding most of the url in part to prevent phishing however I do think they should allow this behaviour to be toggled via a flag. [0] https://youtu.be/0-wB1VY3Nrc https://youtu.be/0-wB1VY3Nrc

mkl 6y ago
Do you know if this information is somewhere more accessible than a 20 minute video? Hiding the https and www is already frustrating enough, and this change would make Chrome barely usable for my purposes.
- delouvois 6y ago
  Their goal is full AMP dominance. Just look at these evil guys faces. It's clear enough that they're going to pass their frustrations onto you, no matter what.
- ubercow13 6y ago
  The claimed purpose is basically just to prevent phishing. They explain a number of reasons why it is difficult for people to extract from a URL the part which is relevant to security, ie. the bit that affects who has authority over the page and how your cookies will be separated by the browser. The cookie sharing actually had some rules I didn't know about as a non-web developer but experienced URL user. They show how every browser is already going some way towards this but they all have some problems, for example Safari shows the full domain not just the important part.
  - megous 6y ago
    Looks like this will be great for reflected XSS attacks. Even advanced users will not be able to notice there's something weird going on outside of the domain name part of the URL. Perfect! Basically any page on the website with this vulnerability will be useable to show a fake login page, and user will not even notice he's not on the /login, but on some weird path + ?_sort=somejavascript Not that it's that hard to clean up url via history api after you get access to the page via XSS atm, but there's still some short period of time where the full url is shown in such a case, that may provoke suspicion.
    - joshuamorton 6y ago
      Stick "?jsessionid=<random 80 character string>" in front of the xss and no one will ever look.

mkl 6y ago

Do you know if this information is somewhere more accessible than a 20 minute video? Hiding the https and www is already frustrating enough, and this change would make Chrome barely usable for my purposes.

delouvois 6y ago
Their goal is full AMP dominance. Just look at these evil guys faces. It's clear enough that they're going to pass their frustrations onto you, no matter what.
ubercow13 6y ago
The claimed purpose is basically just to prevent phishing. They explain a number of reasons why it is difficult for people to extract from a URL the part which is relevant to security, ie. the bit that affects who has authority over the page and how your cookies will be separated by the browser. The cookie sharing actually had some rules I didn't know about as a non-web developer but experienced URL user. They show how every browser is already going some way towards this but they all have some problems, for example Safari shows the full domain not just the important part.
- megous 6y ago
  Looks like this will be great for reflected XSS attacks. Even advanced users will not be able to notice there's something weird going on outside of the domain name part of the URL. Perfect! Basically any page on the website with this vulnerability will be useable to show a fake login page, and user will not even notice he's not on the /login, but on some weird path + ?_sort=somejavascript Not that it's that hard to clean up url via history api after you get access to the page via XSS atm, but there's still some short period of time where the full url is shown in such a case, that may provoke suspicion.
  - joshuamorton 6y ago
    Stick "?jsessionid=<random 80 character string>" in front of the xss and no one will ever look.