4 ms·

> But that's useful information that's told me redundantly by the page title and the banner at the top of the page also. I don't need the URL bar for that. The

by zrm 6y ago

> But that's useful information that's told me redundantly by the page title and the banner at the top of the page also. I don't need the URL bar for that. The page isn't required by anything to contain that information or to give it accurately. How do you distinguish example.edu/financial-aid/ from example.edu/~some-student/ ? > In fact, using the URL bar for it assumes that the path has semantic meaning, which is not an assumption that the URL standard actually requires. It doesn't assume anything, it just shows you the URL. If it has semantic meaning then you can see that -- which it commonly does.

shadowgovt 6y ago
> How do you distinguish example.edu/financial-aid/ from example.edu/~some-student/ That's an unrealistic example because no website worth its salt is going to let students put arbitrary content in the same domain as the financial aid system. That's a recipe for leaking cookies that contain session tokens, and displaying a full URL won't save a user. By the time you see the ~some-student in the URL bar, the security game is over.
- zrm 6y ago
  You're making a lot of assumptions there. It could be that example.edu/financial-aid/ is just information and PDFs and doesn't have any sessions or cookies. Or the real financial aid system is on another domain, but a first time user doesn't know that, they're just looking at www.example.edu/~some-student/ which appears to be a financial aid page that Chrome only says is example.edu. Or any other case where the contents of the URL matters. How about example.edu/~some-student/ vs. example.edu/~a-different-student/ or example.edu/~your-professor/?
  - shadowgovt 6y ago
    That hypothetical naive first-time user is going to be as fooled by ~financial-aid, or by ~some-user/financial-aid. Showing the full URL path doesn't fix that risk scenario. The other scenario you describe, if the risk is someone intentionally deceiving users by cloning a page on the university network owned by someone else for deceptive purposes, is better solved by a university disciplinary hearing than by expecting every student to understand URL paths.
    - zrm 6y ago
      > That hypothetical naive first-time user is going to be as fooled by ~financial-aid, or by ~some-user/financial-aid. The attacker may not be able to get ~financial-aid, only ~juan-ramirez, and even if you don't know about home directories, the first thing that strikes you about ~juan-ramirez/financial-aid is that something is wrong because you are not Juan Ramirez. If you do know about home directories then it's a giant red flag which you can't see if the browser is hiding it from you. It doesn't have to prevent 100% of attacks. Preventing 7% of attacks is still 7% better than nothing. > The other scenario you describe, if the risk is someone intentionally deceiving users by cloning a page on the university network owned by someone else for deceptive purposes, is better solved by a university disciplinary hearing than by expecting every student to understand URL paths. The most common way things like that happen isn't the actual student who would have to be using their own name, it's that the student uses a weak password or gets their computer infected with malware and then some Russian hacker sets up on their school account. You also don't need every user to understand them, only one who then reports it. If you don't show the paths to anybody then much more likely that nobody notices, or that it takes longer for somebody to notice and more people get compromised in the meantime.
      - shadowgovt 6y ago
        > the first thing that strikes you about ~juan-ramirez/financial-aid is that something is wrong because you are not Juan Ramirez User studies indicate that the first thing a user notices is... Nothing. The gobbledygook in the path is so much noise for the average user that they don't notice if the path seems off. In fact, it makes sense to hide it from a security standpoint to decrease the odds that users go information blind to the domain, because we already know that improper domain routing to lookalike domains is, by far, the most common vector for credential theft. There isn't even a guarantee that showing the path to address the 7% case (which really looks like more 0.07%) will on average cause the incidence of users being compromised to go down, if it means users are less likely to notice that the subdomain and domain are off. I'm sure that for the people who really care, it won't take long to hack together a chrome extension that drops the full URL into the page title or a pop-up box on the page itself.

by zrm 6y ago

shadowgovt 6y ago

> How do you distinguish example.edu/financial-aid/ from example.edu/~some-student/ That's an unrealistic example because no website worth its salt is going to let students put arbitrary content in the same domain as the financial aid system. That's a recipe for leaking cookies that contain session tokens, and displaying a full URL won't save a user. By the time you see the ~some-student in the URL bar, the security game is over.

zrm 6y ago
You're making a lot of assumptions there. It could be that example.edu/financial-aid/ is just information and PDFs and doesn't have any sessions or cookies. Or the real financial aid system is on another domain, but a first time user doesn't know that, they're just looking at www.example.edu/~some-student/ which appears to be a financial aid page that Chrome only says is example.edu. Or any other case where the contents of the URL matters. How about example.edu/~some-student/ vs. example.edu/~a-different-student/ or example.edu/~your-professor/?
- shadowgovt 6y ago
  That hypothetical naive first-time user is going to be as fooled by ~financial-aid, or by ~some-user/financial-aid. Showing the full URL path doesn't fix that risk scenario. The other scenario you describe, if the risk is someone intentionally deceiving users by cloning a page on the university network owned by someone else for deceptive purposes, is better solved by a university disciplinary hearing than by expecting every student to understand URL paths.
  - zrm 6y ago
    > That hypothetical naive first-time user is going to be as fooled by ~financial-aid, or by ~some-user/financial-aid. The attacker may not be able to get ~financial-aid, only ~juan-ramirez, and even if you don't know about home directories, the first thing that strikes you about ~juan-ramirez/financial-aid is that something is wrong because you are not Juan Ramirez. If you do know about home directories then it's a giant red flag which you can't see if the browser is hiding it from you. It doesn't have to prevent 100% of attacks. Preventing 7% of attacks is still 7% better than nothing. > The other scenario you describe, if the risk is someone intentionally deceiving users by cloning a page on the university network owned by someone else for deceptive purposes, is better solved by a university disciplinary hearing than by expecting every student to understand URL paths. The most common way things like that happen isn't the actual student who would have to be using their own name, it's that the student uses a weak password or gets their computer infected with malware and then some Russian hacker sets up on their school account. You also don't need every user to understand them, only one who then reports it. If you don't show the paths to anybody then much more likely that nobody notices, or that it takes longer for somebody to notice and more people get compromised in the meantime.
    - shadowgovt 6y ago
      > the first thing that strikes you about ~juan-ramirez/financial-aid is that something is wrong because you are not Juan Ramirez User studies indicate that the first thing a user notices is... Nothing. The gobbledygook in the path is so much noise for the average user that they don't notice if the path seems off. In fact, it makes sense to hide it from a security standpoint to decrease the odds that users go information blind to the domain, because we already know that improper domain routing to lookalike domains is, by far, the most common vector for credential theft. There isn't even a guarantee that showing the path to address the 7% case (which really looks like more 0.07%) will on average cause the incidence of users being compromised to go down, if it means users are less likely to notice that the subdomain and domain are off. I'm sure that for the people who really care, it won't take long to hack together a chrome extension that drops the full URL into the page title or a pop-up box on the page itself.