4 ms·
> That hypothetical naive first-time user is going to be as fooled by ~financial-aid, or by ~some-user/financial-aid. The attacker may not be able to get ~fina
by zrm 6y ago
> That hypothetical naive first-time user is going to be as fooled by ~financial-aid, or by ~some-user/financial-aid.
The attacker may not be able to get ~financial-aid, only ~juan-ramirez, and even if you don't know about home directories, the first thing that strikes you about ~juan-ramirez/financial-aid is that something is wrong because you are not Juan Ramirez. If you do know about home directories then it's a giant red flag which you can't see if the browser is hiding it from you.
It doesn't have to prevent 100% of attacks. Preventing 7% of attacks is still 7% better than nothing.
> The other scenario you describe, if the risk is someone intentionally deceiving users by cloning a page on the university network owned by someone else for deceptive purposes, is better solved by a university disciplinary hearing than by expecting every student to understand URL paths.
The most common way things like that happen isn't the actual student who would have to be using their own name, it's that the student uses a weak password or gets their computer infected with malware and then some Russian hacker sets up on their school account.
You also don't need every user to understand them, only one who then reports it. If you don't show the paths to anybody then much more likely that nobody notices, or that it takes longer for somebody to notice and more people get compromised in the meantime.
- shadowgovt 6y ago> the first thing that strikes you about ~juan-ramirez/financial-aid is that something is wrong because you are not Juan Ramirez User studies indicate that the first thing a user notices is... Nothing. The gobbledygook in the path is so much noise for the average user that they don't notice if the path seems off. In fact, it makes sense to hide it from a security standpoint to decrease the odds that users go information blind to the domain, because we already know that improper domain routing to lookalike domains is, by far, the most common vector for credential theft. There isn't even a guarantee that showing the path to address the 7% case (which really looks like more 0.07%) will on average cause the incidence of users being compromised to go down, if it means users are less likely to notice that the subdomain and domain are off. I'm sure that for the people who really care, it won't take long to hack together a chrome extension that drops the full URL into the page title or a pop-up box on the page itself.
- zrm 6y ago> User studies indicate that the first thing a user notices is... Nothing. There are a thousand ways to screw up a user study, but one of the best ways to detect a screw up is if they say that users either always or never do something. > In fact, it makes sense to hide it from a security standpoint to decrease the odds that users go information blind to the domain, because we already know that improper domain routing to lookalike domains is, by far, the most common vector for credential theft. Which is why it makes sense to highlight the domain. Make it a different color. Make it a bigger font size. That still doesn't require you to omit the rest of the URL. > I'm sure that for the people who really care, it won't take long to hack together a chrome extension that drops the full URL into the page title or a pop-up box on the page itself. Except that the people who actually do that really are the 0.07% and you've still lost the 6.93% who would've noticed if you'd put it in front of them but aren't about actively change the default you gave them ahead of time.
- shadowgovt 6y agoYou're using concrete numbers but you don't have the statistics or analysis to know what the numbers are. I'm going to assume the company that has telemetry on its own product does. ... but probably more importantly, nobody likely needs to hack together an extension after all. Older news story about how Chrome will add an option to show the full URL bar as non-default. https://www.zdnet.com/article/googles-chrome-will-give-you-an-always-show-full-url-setting/ https://www.zdnet.com/article/googles-chrome-will-give-you-a...