> User studies indicate that the first thing a user notices is... Nothing. There are a thousand ways to screw up a user study, but one of the best ways to dete

> User studies indicate that the first thing a user notices is... Nothing. There are a thousand ways to screw up a user study, but one of the best ways to detect a screw up is if they say that users either always or never do something. > In fact, it makes sense to hide it from a security standpoint to decrease the odds that users go information blind to the domain, because we already know that improper domain routing to lookalike domains is, by far, the most common vector for credential theft. Which is why it makes sense to highlight the domain. Make it a different color. Make it a bigger font size. That still doesn't require you to omit the rest of the URL. > I'm sure that for the people who really care, it won't take long to hack together a chrome extension that drops the full URL into the page title or a pop-up box on the page itself. Except that the people who actually do that really are the 0.07% and you've still lost the 6.93% who would've noticed if you'd put it in front of them but aren't about actively change the default you gave them ahead of time.