3 ms·

"Showing the full URL may detract from the parts of the URL that are more important to making a security decision on a webpage". Oh, really? As a security-awar

"Showing the full URL may detract from the parts of the URL that are more important to making a security decision on a webpage". Oh, really? As a security-aware user I really want to see the full URL to make sure it doesn't look something like https://big-vulnerable-site.com/?redirect_url=http://my-malicious-site.com https://big-vulnerable-site.com/?redirect_url=http://my-mali.... I fail to see a single use case where showing only the hostname or the domain increases the security of the browsing experience. But by now I'm also quite use to Google's way of shamelessly lying their way through.

Spivak 6y ago
Huh? If I was trying to get people to see that paypal.com.myevilsite.info/paypal/auth/secure then having myevilsite.com be the most prominent thing seems like a win.
oconnor663 6y ago
> I fail to see a single use case where showing only the hostname or the domain increases the security of the browsing experience. For you, a power user with presumably years (decades?) using the web and general technical fluency, sure. This doesn't particularly benefit you. The person it benefits is a beginner (possibly a permanent beginner), who's needs to be taught to look at the domain name of websites before typing in their password. This is already an unfamiliar and uncomfortable concept for a lot of people, and forcing them to parse a long string of line noise to find the thing they're supposed to check makes it worse. It's very difficult to for technical experts to put ourselves in the shoes of a permanent beginner. We like using computers. A lot of them hate it, but have to do it to pay their taxes or make appointments with their doctor or see photos of their relatives. We think the idea of protecting ourselves from attackers is neat, because it makes us feel in control. A lot of them think it's horrifying, because they feel out of control and exposed. Adding extra little steps, or little opportunities for confusion, has a big impact on these folks, and they need all the help they can get.

Spivak 6y ago

Huh? If I was trying to get people to see that paypal.com.myevilsite.info/paypal/auth/secure then having myevilsite.com be the most prominent thing seems like a win.

oconnor663 6y ago

> I fail to see a single use case where showing only the hostname or the domain increases the security of the browsing experience. For you, a power user with presumably years (decades?) using the web and general technical fluency, sure. This doesn't particularly benefit you. The person it benefits is a beginner (possibly a permanent beginner), who's needs to be taught to look at the domain name of websites before typing in their password. This is already an unfamiliar and uncomfortable concept for a lot of people, and forcing them to parse a long string of line noise to find the thing they're supposed to check makes it worse. It's very difficult to for technical experts to put ourselves in the shoes of a permanent beginner. We like using computers. A lot of them hate it, but have to do it to pay their taxes or make appointments with their doctor or see photos of their relatives. We think the idea of protecting ourselves from attackers is neat, because it makes us feel in control. A lot of them think it's horrifying, because they feel out of control and exposed. Adding extra little steps, or little opportunities for confusion, has a big impact on these folks, and they need all the help they can get.