5 ms·

I get emails from some banks with instructions to spot phishing. One of those is to look at the full URL in emails or on websites to know if it’s authentic or n

by AnonHP 6y ago

I get emails from some banks with instructions to spot phishing. One of those is to look at the full URL in emails or on websites to know if it’s authentic or not. For better or worse, the URL scheme is what we have to identify websites and pages. Hiding that on larger screens doesn’t make much sense. It also hinders learning for the next generation.

mkl 6y ago
Actually, that's their argument for doing it. Most users don't understand the different bits of a URL, to know whether it's from the site they think it's from. See (huge) previous discussion from two months ago: https://news.ycombinator.com/item?id=23516088 https://news.ycombinator.com/item?id=23516088 Personally, for my own purposes, I think hiding any bit of the URL is incredibly inconvenient. Already hiding the www. is seriously annoying. I will switch this new behaviour off and hope they don't remove that option.
- HumblyTossed 6y ago
  > Actually, that's their argument for doing it. If AMP didn't exist I might be slightly more inclined to believe them.
  - mkl 6y ago
    They have a plan for that, too, a proposed standard (SXG: Signed HTTP Exchanges, currently only supported in Chrome and derivatives) that lets them hide the fact that AMP is being used: https://developers.google.com/web/updates/2018/11/signed-exchanges https://developers.google.com/web/updates/2018/11/signed-exc... and more background: https://www.eff.org/deeplinks/2020/07/googles-amp-canonical-web-and-importance-web-standards-0 https://www.eff.org/deeplinks/2020/07/googles-amp-canonical-...
- aquova 6y ago
  If that's really their justification, then I wish they would take the approach that Firefox does - show the full URL but have the domain name in white and the rest of the URL in a muted color. It provides the full information as well as highlighting the most important info for spotting a phishing scheme.
  - oefrha 6y ago
    > show the full URL but have the domain name in white and the rest of the URL in a muted color Which is exactly what they do at the moment.
    - thadjo 6y ago
      wow I've never noticed this. it's pretty subtle.
    - _underfl0w_ 6y ago
      Meaning that the need for the new hiding feature is... what, exactly?
      - untog 6y ago
        Presumably that a number of users still don’t get it and the value to the remaining users is very small.
  - mkr-hn 6y ago
    I didn't notice Firefox does this before your comment. On my screen the domain is black and the rest of it is gray. Maybe it's because I don't have any kind of night mode thing on. I'm sure the colors would be inverted with that enabled.
- dwheeler 6y ago
  It is not just inconvenient, hiding or modifying URLs is a lie and is a security problem. Hiding part of the URL means that you don't really see what's going on, and that is the first step towards a security problem, not away from it.
  - athenot 6y ago
    I agree. But I'm afraid Google's solution is going to be along the lines of showing a green mark for anything served from their own servers, with the subtle implication that anything else is less trustworthy.
  - UncleMeat 6y ago
    All of the TLS handshake configurations are hidden from your UI. It is hard to see "what's going on". You aren't shown a cert signature each time you request a page. Yet the lock icon doesn't get hate. The non-domain information in a URL is useless for making security decisions for virtually 100% of users. If anything, it has negative utility since you can make URLs nearly arbitrarily confusing as part of a phishing attack.
    - saagarjha 6y ago
      I don’t understand, the lock icon gives you exactly the information you could want from that though? It tells you immediately if the site you are on is HTTPS, you don’t have to hover or anything. And if you want even more details (which is not something anyone does while they browse the internet, FWIW) you can also get that information too. This change hides the information that people actually expect that UI to have–that’s why there’s an option to in-hide it!
      - UncleMeat 6y ago
        What if I want more information? I want to know what TLS version both parties negotiated. I want to know who signed the cert and when it expires. Etc. etc. The point is that "the UI should express everything a power user could ever want to know about some security-adjacent property" is not the status-quo and people should not act like it is. Dropping to just domains is like shifting from a big blob of text including a ton of request information to just the lock icon. It distills it to something that covers basically all the information you'd ever actually need and is comprehensible to typical users.
- jpt1 6y ago
  I didn't know there is an option to change it back, thanks for pointing that out. I've found it really frustrating when trying to copy different parts of the URL.
- ffwd 6y ago
  Just fyi, the google chrome plugin "Suspicious Site Reporter" reverts the url back to how it always was, with http:// http:// and www and everything else. It's very lightweight and you can just leave it on, don't have to report anything or do anything with it. Hopefully it remains this way _forever_, even with these newer changes as well.
  - tbodt 6y ago
    Or you can right click the omnibox and choose "Always show full URLs"
dayjobpork 6y ago
Countdown until scammers figure out a way to screw up the parsing code and get Chrome to show the incorrect fake url
eli 6y ago
The bank may say that, but it's not actually good or practical advice.
ziml77 6y ago
Embarrassingly I let checking the URL bar give me a false sense of security and got phished for the first time just a few days ago. They put a fake URL bar into the page and made it look like a proper OAuth2 URL. (My 2nd factor saved me from giving them access since it slowed me down enough to notice some subtle oddities, but I still had to change the password since that was already submitted) The real protection against this is making it impossible for me to send credentials to the wrong party. Normally my password manager helps with that, but I had just switched managers a couple days before and it wasn't recognizing all sites properly (likely due to the lack of a database of known equivalent URLs). If the site was using WebAuthn, there wouldn't have been any issue because the imperfect URL checks by me and the password manager would not be necessary.
rnet85 6y ago
This has been the standard on safari for years. Are you saying that people who use safari suffer from those problems?

by AnonHP 6y ago

mkl 6y ago

Actually, that's their argument for doing it. Most users don't understand the different bits of a URL, to know whether it's from the site they think it's from. See (huge) previous discussion from two months ago: https://news.ycombinator.com/item?id=23516088 https://news.ycombinator.com/item?id=23516088 Personally, for my own purposes, I think hiding any bit of the URL is incredibly inconvenient. Already hiding the www. is seriously annoying. I will switch this new behaviour off and hope they don't remove that option.

HumblyTossed 6y ago
> Actually, that's their argument for doing it. If AMP didn't exist I might be slightly more inclined to believe them.
- mkl 6y ago
  They have a plan for that, too, a proposed standard (SXG: Signed HTTP Exchanges, currently only supported in Chrome and derivatives) that lets them hide the fact that AMP is being used: https://developers.google.com/web/updates/2018/11/signed-exchanges https://developers.google.com/web/updates/2018/11/signed-exc... and more background: https://www.eff.org/deeplinks/2020/07/googles-amp-canonical-web-and-importance-web-standards-0 https://www.eff.org/deeplinks/2020/07/googles-amp-canonical-...
aquova 6y ago
If that's really their justification, then I wish they would take the approach that Firefox does - show the full URL but have the domain name in white and the rest of the URL in a muted color. It provides the full information as well as highlighting the most important info for spotting a phishing scheme.
- oefrha 6y ago
  > show the full URL but have the domain name in white and the rest of the URL in a muted color Which is exactly what they do at the moment.
  - thadjo 6y ago
    wow I've never noticed this. it's pretty subtle.
  - _underfl0w_ 6y ago
    Meaning that the need for the new hiding feature is... what, exactly?
    - untog 6y ago
      Presumably that a number of users still don’t get it and the value to the remaining users is very small.
- mkr-hn 6y ago
  I didn't notice Firefox does this before your comment. On my screen the domain is black and the rest of it is gray. Maybe it's because I don't have any kind of night mode thing on. I'm sure the colors would be inverted with that enabled.
dwheeler 6y ago
It is not just inconvenient, hiding or modifying URLs is a lie and is a security problem. Hiding part of the URL means that you don't really see what's going on, and that is the first step towards a security problem, not away from it.
- athenot 6y ago
  I agree. But I'm afraid Google's solution is going to be along the lines of showing a green mark for anything served from their own servers, with the subtle implication that anything else is less trustworthy.
- UncleMeat 6y ago
  All of the TLS handshake configurations are hidden from your UI. It is hard to see "what's going on". You aren't shown a cert signature each time you request a page. Yet the lock icon doesn't get hate. The non-domain information in a URL is useless for making security decisions for virtually 100% of users. If anything, it has negative utility since you can make URLs nearly arbitrarily confusing as part of a phishing attack.
  - saagarjha 6y ago
    I don’t understand, the lock icon gives you exactly the information you could want from that though? It tells you immediately if the site you are on is HTTPS, you don’t have to hover or anything. And if you want even more details (which is not something anyone does while they browse the internet, FWIW) you can also get that information too. This change hides the information that people actually expect that UI to have–that’s why there’s an option to in-hide it!
    - UncleMeat 6y ago
      What if I want more information? I want to know what TLS version both parties negotiated. I want to know who signed the cert and when it expires. Etc. etc. The point is that "the UI should express everything a power user could ever want to know about some security-adjacent property" is not the status-quo and people should not act like it is. Dropping to just domains is like shifting from a big blob of text including a ton of request information to just the lock icon. It distills it to something that covers basically all the information you'd ever actually need and is comprehensible to typical users.
jpt1 6y ago
I didn't know there is an option to change it back, thanks for pointing that out. I've found it really frustrating when trying to copy different parts of the URL.
ffwd 6y ago
Just fyi, the google chrome plugin "Suspicious Site Reporter" reverts the url back to how it always was, with http:// http:// and www and everything else. It's very lightweight and you can just leave it on, don't have to report anything or do anything with it. Hopefully it remains this way _forever_, even with these newer changes as well.
- tbodt 6y ago
  Or you can right click the omnibox and choose "Always show full URLs"

dayjobpork 6y ago

Countdown until scammers figure out a way to screw up the parsing code and get Chrome to show the incorrect fake url

eli 6y ago

The bank may say that, but it's not actually good or practical advice.

ziml77 6y ago

Embarrassingly I let checking the URL bar give me a false sense of security and got phished for the first time just a few days ago. They put a fake URL bar into the page and made it look like a proper OAuth2 URL. (My 2nd factor saved me from giving them access since it slowed me down enough to notice some subtle oddities, but I still had to change the password since that was already submitted) The real protection against this is making it impossible for me to send credentials to the wrong party. Normally my password manager helps with that, but I had just switched managers a couple days before and it wasn't recognizing all sites properly (likely due to the lack of a database of known equivalent URLs). If the site was using WebAuthn, there wouldn't have been any issue because the imperfect URL checks by me and the password manager would not be necessary.

rnet85 6y ago

This has been the standard on safari for years. Are you saying that people who use safari suffer from those problems?