6 ms·

My first thought when reading this was relief... For my mother. I've spent most of my adult life trying to teach my parents to look at the address bar to make

My first thought when reading this was relief... For my mother. I've spent most of my adult life trying to teach my parents to look at the address bar to make sure they're on bankofamerica.com and not some random phishing domain. That kind of falls apart though when it's... bankofamerica.comm.phishingdom.com/{random filler}/bankofamerica/user/login HN users are fantastic at thinking all technologies should revolve around their niche use case.

p7hwfizeONj 6y ago
It looks like non-trivial subdomains will still appear and those seem to me to be the most problematic.
dgb23 6y ago
The root domain is highlighted in FF. This must be enough for visual testing. If you want a more reliable approach then you need to work with a whitelist and clear warnings.
- summerlight 6y ago
  I wouldn't assert it without strong evidence. This URL comprehension problem is probably more complex than what people usually think. There are a number of studies about this issue, if you're interested. https://storage.googleapis.com/pub-tools-public-publication-data/pdf/400599205ab5a1c9efa03e2a7c127eb8200bf288.pdf https://storage.googleapis.com/pub-tools-public-publication-... https://kumarde.com/papers/urls.pdf https://kumarde.com/papers/urls.pdf
  - dgb23 6y ago
    Thank you for those! Side question: I don't have a formal education in CS, but I really enjoy reading papers on programming (languages), architecture, data-engineering and web related things among others, especially when they have a practical focus/impact. Is there a good way for me to find or rather discover resources like these?
    - automatoney 6y ago
      Not sure about filtering for practical focus/impact but https://arxiv.org/ https://arxiv.org/ is an amazingly useful and informative repository of papers that you might like. Also google scholar is good, but more general.
- Corrado 6y ago
  > The root domain is highlighted in FF. This must be enough for visual testing. I've been using Firefox for years and never realized this. Looking up at the top of my browser, I can see that "ycombinator.com" is highlighted and the rest of the URL is a darker grey. To me, this seems like a good compromise; you still get the full URL but the important parts stand out a bit more.
donor20 6y ago
Exactly - also if you do any penetration testing of your staff side - the key to get something through is have the name of the company it seems anywhere in the URL. Literally - lkjljkdfskjfsd.com/bankofamerica/securelogin.do etc. Part of the issue I've noticed is some sites actually do outsource things to other sites (microsoft has a lot of redirects on logins so you used to end up on passport.com I think to login, and then to something with azure, then office... etc). Combine this with subdomains and trailing urls and internationalization efforts and you are in trouble. This must be just because of how we scan / read things? Ie, a quick cross check. A lot of people maybe don't parse all the elements properly (,.:?& etc). The other issue - let's say just 2-5% of chrome users are confused. That still is a HUGE number that are confused.

p7hwfizeONj 6y ago

It looks like non-trivial subdomains will still appear and those seem to me to be the most problematic.

dgb23 6y ago

The root domain is highlighted in FF. This must be enough for visual testing. If you want a more reliable approach then you need to work with a whitelist and clear warnings.

summerlight 6y ago
I wouldn't assert it without strong evidence. This URL comprehension problem is probably more complex than what people usually think. There are a number of studies about this issue, if you're interested. https://storage.googleapis.com/pub-tools-public-publication-data/pdf/400599205ab5a1c9efa03e2a7c127eb8200bf288.pdf https://storage.googleapis.com/pub-tools-public-publication-... https://kumarde.com/papers/urls.pdf https://kumarde.com/papers/urls.pdf
- dgb23 6y ago
  Thank you for those! Side question: I don't have a formal education in CS, but I really enjoy reading papers on programming (languages), architecture, data-engineering and web related things among others, especially when they have a practical focus/impact. Is there a good way for me to find or rather discover resources like these?
  - automatoney 6y ago
    Not sure about filtering for practical focus/impact but https://arxiv.org/ https://arxiv.org/ is an amazingly useful and informative repository of papers that you might like. Also google scholar is good, but more general.
Corrado 6y ago
> The root domain is highlighted in FF. This must be enough for visual testing. I've been using Firefox for years and never realized this. Looking up at the top of my browser, I can see that "ycombinator.com" is highlighted and the rest of the URL is a darker grey. To me, this seems like a good compromise; you still get the full URL but the important parts stand out a bit more.

donor20 6y ago

Exactly - also if you do any penetration testing of your staff side - the key to get something through is have the name of the company it seems anywhere in the URL. Literally - lkjljkdfskjfsd.com/bankofamerica/securelogin.do etc. Part of the issue I've noticed is some sites actually do outsource things to other sites (microsoft has a lot of redirects on logins so you used to end up on passport.com I think to login, and then to something with azure, then office... etc). Combine this with subdomains and trailing urls and internationalization efforts and you are in trouble. This must be just because of how we scan / read things? Ie, a quick cross check. A lot of people maybe don't parse all the elements properly (,.:?& etc). The other issue - let's say just 2-5% of chrome users are confused. That still is a HUGE number that are confused.