3 ms·

>hiding URLs does protect users from phishing Real question: how? I would expect it to be the opposite, a perfect phishing site will have the wrong URL.

by tpxl 6y ago

Spivak 6y ago
Because it's not really "hiding the URL" despite what all the outrage bloggers tried to make it seem. It's by default (i.e. until you tap/click it) hiding the parts of the URL that the site controls. So paypal.amazon.citibank.scamsite.biz/secure/login/trustus will just show scamsite.biz.
- deleted 6y ago
  [deleted]
- dumpsterdiver 6y ago
  My first instinct was to distrust the hide-until-click URL bar also, but you've illustrated clearly why it's a reasonable default. It mitigates the effect of malicious websites playing URL games, and allows the browser to more accurately convey to the user where they really are.
- dumpsterdiver 6y ago
  To drive your point home, paypal.amazon.citibank.scamsite.biz/secure/login/trustus will likely have a perfectly valid certificate, along with the trusted green closed-lock before the URL, implying that the site is "secure".
- wool_gather 6y ago
  Safari does not behave as you've described. The subdomain (for example, 'gist' in 'gist.github.com') is displayed.
  - saagarjha 6y ago
    I suspect that Safari uses Public Suffix or similar for that.
greycol 6y ago
google.com.evilwebsite.example?=google.com Oh that has google in it (twice even) we can go there. There's also arguments that URLs are too complex for normal people to understand. I agree with you though, hiding or redirecting URLs is the opposite of protecting users from phishing.
- pdkl95 6y ago
  > google.com.evilwebsite.example?=google.com This was solved a decade ago by rendering the 2nd+1st level domains (and sometimes other parts of the URL) in a different style. > There's also arguments that URLs are too complex for normal people to understand. That argument is an insulting attempt to justify a form of illiteracy[1]. Most people don't need to know all of the technical features of a URL; they just need to be able to use it as an address and recognize basic features like the hostname. Street addresses are a good analogy. Most people understand the basics easily even though physical addresses are far more complex[2] than URLs! [1] https://news.ycombinator.com/item?id=7694919 https://news.ycombinator.com/item?id=7694919 [2] https://news.ycombinator.com/item?id=7695735 https://news.ycombinator.com/item?id=7695735

>hiding URLs does protect users from phishing Real question: how? I would expect it to be the opposite, a perfect phishing site will have the wrong URL.

by tpxl 6y ago

>hiding URLs does protect users from phishing Real question: how? I would expect it to be the opposite, a perfect phishing site will have the wrong URL.

Spivak 6y ago

Because it's not really "hiding the URL" despite what all the outrage bloggers tried to make it seem. It's by default (i.e. until you tap/click it) hiding the parts of the URL that the site controls. So paypal.amazon.citibank.scamsite.biz/secure/login/trustus will just show scamsite.biz.

deleted 6y ago
[deleted]
dumpsterdiver 6y ago
My first instinct was to distrust the hide-until-click URL bar also, but you've illustrated clearly why it's a reasonable default. It mitigates the effect of malicious websites playing URL games, and allows the browser to more accurately convey to the user where they really are.
dumpsterdiver 6y ago
To drive your point home, paypal.amazon.citibank.scamsite.biz/secure/login/trustus will likely have a perfectly valid certificate, along with the trusted green closed-lock before the URL, implying that the site is "secure".
wool_gather 6y ago
Safari does not behave as you've described. The subdomain (for example, 'gist' in 'gist.github.com') is displayed.
- saagarjha 6y ago
  I suspect that Safari uses Public Suffix or similar for that.

greycol 6y ago

google.com.evilwebsite.example?=google.com Oh that has google in it (twice even) we can go there. There's also arguments that URLs are too complex for normal people to understand. I agree with you though, hiding or redirecting URLs is the opposite of protecting users from phishing.

pdkl95 6y ago
> google.com.evilwebsite.example?=google.com This was solved a decade ago by rendering the 2nd+1st level domains (and sometimes other parts of the URL) in a different style. > There's also arguments that URLs are too complex for normal people to understand. That argument is an insulting attempt to justify a form of illiteracy[1]. Most people don't need to know all of the technical features of a URL; they just need to be able to use it as an address and recognize basic features like the hostname. Street addresses are a good analogy. Most people understand the basics easily even though physical addresses are far more complex[2] than URLs! [1] https://news.ycombinator.com/item?id=7694919 https://news.ycombinator.com/item?id=7694919 [2] https://news.ycombinator.com/item?id=7695735 https://news.ycombinator.com/item?id=7695735