6 ms·

"simplified domain" = address bar only shows domain name. e.g. "https://www.ghacks.net/2020/06/15/google-to-test-simplified-domain-display-in-chrome/ https://w

"simplified domain" = address bar only shows domain name. e.g. "https://www.ghacks.net/2020/06/15/google-to-test-simplified-domain-display-in-chrome/ https://www.ghacks.net/2020/06/15/google-to-test-simplified-..." -> "ghacks.net" > The reason for running the experiment, according to a developer, is that the display of the full URL makes it difficult for the average user to distinguish between legitimate and malicious sites. From https://www.ghacks.net/2020/06/15/google-to-test-simplified-domain-display-in-chrome/ https://www.ghacks.net/2020/06/15/google-to-test-simplified-...

cookiengineer 5y ago
Not only that. On mobile, it meant that AMP delivered pages by google's domain were stripped out in a way that the publisher's domain was displayed, effectively MITMing the website from a user's point of view. Maybe the next iteration of it will use SSL certificate hijacking, who knows? I mean, this feature can be argued with from both sides: protection against scam and "UX MITM". What I don't understand is why a web browser doesn't already include scam websites into their malware/badware reporting feature. It could have been so much easier. In Germany we have a very restrictive law when it comes to imprints on websites, which makes it easy to spot scamming websites if you care to look for the legibility of the imprint (and required tax law identification numbers). Of course that doesn't apply for international law, but initially I didn't understand the importance of it...meanwhile I do.
- Case81 5y ago
  “UX MITM” is the funniest thing I’ve heard all week
  - cookiengineer 5y ago
    I don't even know how to call this to be honest. I mean, it's not scam, it's not MITM, it's not fraud but it's still trying to deceive users...so what is it? The only parallel that comes to mind are all the "helpful" clickjacking toolbars in Internet Explorer that tried to push every search and every link to their own results page.
    - matt_kantor 5y ago
      "Dark pattern" fits, but is not very specific.
- serial_dev 5y ago
  I don't understand how the imprints on websites help with scams. Could you elaborate? If someone is scamming people, it wouldn't be too surprising if they do include the imprint or include incorrect data there, wouldn't it?
  - cookiengineer 5y ago
    > I don't understand how the imprints on websites help with scams. Could you elaborate? In imprints there's an address that you can lookup on the Handelsregister. If the HRB matches, and the Handelsregister's Domain for the company matches, too... it's usually an indicator that the website is trustworthy (at least from a legal sue-able-in-case-of-fraud standpoint). Example (never used the website before): - https://www.deerberg.de/service/impressum https://www.deerberg.de/service/impressum - Northdata.de entry checks out (public webservice of Handelsregister entries), with same domain(s) - unternehmen24.info checks out (another public webservice of Handelsregister entries), with same domain(s) - HRB checks out, it's in Lueneburg - DNS records and whois point out it's locally hosted in Lueneburg, too. - Googled Umsatzsteuer-ID, no other (unrelated, scammy looking domain) results - Googled HRB, checks out as well - Google Business Page on Google Maps checks out as well (which might be hijacked, so not trustworthy as indicator alone) - Geschaeftsfuehrer check out as well So yeah, I guess this page/company is legit. You could do this further with LinkedIn and other things like looking up phone numbers in Breaches/Leaks and match the records with the Handelsregister. From an automation perspective this is still a lot of manual research that's necessary; and I guess that this is kind of the real issue at hand - that most people are too lazy to do this sort of background check before they buy something online. But I guess depending on the financial value you're willing to spend some background check beforehand makes more sense if a fraud would financially burden your means of survival afterwards.
    - logifail 5y ago
      > that most people are too lazy to do this sort of background check before they buy something online To be honest that does seem like an awful lot of detective work especially if this would be for a simple online purchase, particularly if the transaction value isn't that high. In many countries you would typically pay online using a credit card or Paypal in which case the card issuer/bank/Paypal provides you with a degree of protection if a product doesn't turn up or isn't what you ordered. In Germany I believe people still are used to there being the option to pay using "Vorkasse" (paying in advance, by bank transfer). I've simply never understood why any buyer would want to assume all the risk by doing that.
salawat 5y ago
>We think this is an important problem area to explore because phishing and other forms of social engineering are still rampant on the web, and much research shows that browsers' current URL display patterns aren't effective defenses. Look... I try not to be too judgemental and keep these types of comments to myself, because generally speaking, breaking new ground is hard. But that statement right there is one of the worst solutions looking for a problem I've ever seen, and even a moment spent actually thinking about the URL, what it was originally for, how one explains it to someone not indoctrinated into tech or the Net, and how the URL has been repurposed and overloaded to be a drop in replacement for implementing Remote Method Invocation through SOA should reveal what the real problem is. Example: Me: Okay, Unusually Observant Gram. This is a URL. A Uniform Resource Locator. Think of it as an address to a webpage. It specifies a mechanism for retrieving something in a computer network. If you put in the same address, you'll come to the same place. UOG: I've heard of the www.com thing before, but what's the http:// http:// and the bunch of slashes afterward? And what's with the question mark I sometimes see after the slashes? Me: The http is the part that specifies the protocol, or how you tell your computer how to get what's at the address. The slashes are the path under the domain, which is the www.com part you're familiar with. UOG: How, pray tell, am I supposed to know what the right way to tell the computer to get what is at that address is if I haven't even been there to see what is there? And you didn't explain the question mark. Me: Well... Good question. Good question. You see, it's fairly rare that you just go visiting one of these places without hearing about it first. So the person giving you the URL just tells you that to save you the trouble. The question mark starts what is called a query, which is a list of named data values you're bringing with you for when you arrive to hand to what's there. If the domain is the building, the path is directions through the building, and the query is extra stuff you give to the person serving the page to do something with. UOG: Wait, I have to give them something? How do I know what I need to give them so I make sure I have it before going through all the work to visit them at their address? Me: <Awkward pause> Well, normally you don't, actually. You either figure it out by trial and error, you read about it somewhere, or they design their webpage in such a way that it knows all that and does it for you. UOG: I thought you said it was an address? Like a place? That I visit? Then follow a series of directions within, and sometimes have to bring something with me, that I don't have any way of knowing about until I visit, and end up embarrassed because I have to turn around and go get what I didn't know I had to pack. Now you're telling me not only is it a place, but somehow that place can itself move, to visit another place? This does not sound like an address to me. This sounds like there is way more to it than that. Me: You're enjoying this way too much. UOG: Immensely. Please continue explaining. I still have a ball of yarn that needs to be turned into a sweater. Me: Okay. So... Yes. All of what you said is correct, but you seem to be conflating the place led to by the address with the thing actually at that place. UOG: Oh, that makes sense. Alright. Where is www.example.com? What's around it? Who are it's neighbors? How is the neighborhood? Me: Okay, the address analogy is getting a little thin. It's not like you can see nearby things from any of these, except through links embedded in the thing-that-is-at-the-address. In fact, if you change even one letter of the address, you'll either not get anything, or you'll get something completely different than what you were looking for. Like you could end up on the other side of town, or in a completely different city. UOG: Oh my! Surely there is a way to tell when this has happened? Like, I should be able to see exactly where one of these lynxes you're talking drags me off to? Me: I see what you did there, and no, there is no guarantee. In fact, some people intentionally set up malicious things at addresses that are easy or frequent typos of another address, and make the page you see as similar as possible to the untypo'd address in the hopes you might disclose valuable information without noticing the mistake you made in the address. UOG: Wait... People trade in these addresses? I thought you said if I went to the same address I'd get to the same thing! What if the owner changes of an address I rely on? This seems really confusing, and like even less of an address that can be relied upon for producing consistent results. This seems like it's only a bare thread away from unravelling into a big mess. Me: Like your sweater? UOG: Shush. ...I mean, I could go on writing, but I'm willing to bet anyone should be able to recognize the problem was never the protocol, or path, or query part of a URL that caused confusion, it was the domain name itself. It completely clashes with most humans innate understandings and heuristics involved with navigating in the Real World. So ironically, they took information that could be usefully applied to giving away a fraudulent address...to only display the most readily misread bit of information with the fewest guarantees that where you're visiting is actually the same place you want to be. It only gets more confusing once you start trying to explain DNS and how they that control the DNS servers determine where requests by everyone else land, because there's actually this other address underneath it called an IP address... Honestly, I should just write a book at this point.
KronisLV 5y ago
Hmm, doesn't the latest version of Firefox show the domain in a slightly highlighted way? Wouldn't that be a good middle ground, if we wanted to make URLs easier to distinguish for the average user, without explicitly hiding that information? Example: https://i.imgur.com/KludkrC.png https://i.imgur.com/KludkrC.png
- mkl 5y ago
  Chrome has done something similar for a long time, but keeps subdomains the same colour as the main domain (and deemphasises the path part).
curryslapper 5y ago
isn't doing something like bolding the domain a better solution?

cookiengineer 5y ago

Not only that. On mobile, it meant that AMP delivered pages by google's domain were stripped out in a way that the publisher's domain was displayed, effectively MITMing the website from a user's point of view. Maybe the next iteration of it will use SSL certificate hijacking, who knows? I mean, this feature can be argued with from both sides: protection against scam and "UX MITM". What I don't understand is why a web browser doesn't already include scam websites into their malware/badware reporting feature. It could have been so much easier. In Germany we have a very restrictive law when it comes to imprints on websites, which makes it easy to spot scamming websites if you care to look for the legibility of the imprint (and required tax law identification numbers). Of course that doesn't apply for international law, but initially I didn't understand the importance of it...meanwhile I do.

Case81 5y ago
“UX MITM” is the funniest thing I’ve heard all week
- cookiengineer 5y ago
  I don't even know how to call this to be honest. I mean, it's not scam, it's not MITM, it's not fraud but it's still trying to deceive users...so what is it? The only parallel that comes to mind are all the "helpful" clickjacking toolbars in Internet Explorer that tried to push every search and every link to their own results page.
  - matt_kantor 5y ago
    "Dark pattern" fits, but is not very specific.
serial_dev 5y ago
I don't understand how the imprints on websites help with scams. Could you elaborate? If someone is scamming people, it wouldn't be too surprising if they do include the imprint or include incorrect data there, wouldn't it?
- cookiengineer 5y ago
  > I don't understand how the imprints on websites help with scams. Could you elaborate? In imprints there's an address that you can lookup on the Handelsregister. If the HRB matches, and the Handelsregister's Domain for the company matches, too... it's usually an indicator that the website is trustworthy (at least from a legal sue-able-in-case-of-fraud standpoint). Example (never used the website before): - https://www.deerberg.de/service/impressum https://www.deerberg.de/service/impressum - Northdata.de entry checks out (public webservice of Handelsregister entries), with same domain(s) - unternehmen24.info checks out (another public webservice of Handelsregister entries), with same domain(s) - HRB checks out, it's in Lueneburg - DNS records and whois point out it's locally hosted in Lueneburg, too. - Googled Umsatzsteuer-ID, no other (unrelated, scammy looking domain) results - Googled HRB, checks out as well - Google Business Page on Google Maps checks out as well (which might be hijacked, so not trustworthy as indicator alone) - Geschaeftsfuehrer check out as well So yeah, I guess this page/company is legit. You could do this further with LinkedIn and other things like looking up phone numbers in Breaches/Leaks and match the records with the Handelsregister. From an automation perspective this is still a lot of manual research that's necessary; and I guess that this is kind of the real issue at hand - that most people are too lazy to do this sort of background check before they buy something online. But I guess depending on the financial value you're willing to spend some background check beforehand makes more sense if a fraud would financially burden your means of survival afterwards.
  - logifail 5y ago
    > that most people are too lazy to do this sort of background check before they buy something online To be honest that does seem like an awful lot of detective work especially if this would be for a simple online purchase, particularly if the transaction value isn't that high. In many countries you would typically pay online using a credit card or Paypal in which case the card issuer/bank/Paypal provides you with a degree of protection if a product doesn't turn up or isn't what you ordered. In Germany I believe people still are used to there being the option to pay using "Vorkasse" (paying in advance, by bank transfer). I've simply never understood why any buyer would want to assume all the risk by doing that.

salawat 5y ago

>We think this is an important problem area to explore because phishing and other forms of social engineering are still rampant on the web, and much research shows that browsers' current URL display patterns aren't effective defenses. Look... I try not to be too judgemental and keep these types of comments to myself, because generally speaking, breaking new ground is hard. But that statement right there is one of the worst solutions looking for a problem I've ever seen, and even a moment spent actually thinking about the URL, what it was originally for, how one explains it to someone not indoctrinated into tech or the Net, and how the URL has been repurposed and overloaded to be a drop in replacement for implementing Remote Method Invocation through SOA should reveal what the real problem is. Example: Me: Okay, Unusually Observant Gram. This is a URL. A Uniform Resource Locator. Think of it as an address to a webpage. It specifies a mechanism for retrieving something in a computer network. If you put in the same address, you'll come to the same place. UOG: I've heard of the www.com thing before, but what's the http:// http:// and the bunch of slashes afterward? And what's with the question mark I sometimes see after the slashes? Me: The http is the part that specifies the protocol, or how you tell your computer how to get what's at the address. The slashes are the path under the domain, which is the www.com part you're familiar with. UOG: How, pray tell, am I supposed to know what the right way to tell the computer to get what is at that address is if I haven't even been there to see what is there? And you didn't explain the question mark. Me: Well... Good question. Good question. You see, it's fairly rare that you just go visiting one of these places without hearing about it first. So the person giving you the URL just tells you that to save you the trouble. The question mark starts what is called a query, which is a list of named data values you're bringing with you for when you arrive to hand to what's there. If the domain is the building, the path is directions through the building, and the query is extra stuff you give to the person serving the page to do something with. UOG: Wait, I have to give them something? How do I know what I need to give them so I make sure I have it before going through all the work to visit them at their address? Me: <Awkward pause> Well, normally you don't, actually. You either figure it out by trial and error, you read about it somewhere, or they design their webpage in such a way that it knows all that and does it for you. UOG: I thought you said it was an address? Like a place? That I visit? Then follow a series of directions within, and sometimes have to bring something with me, that I don't have any way of knowing about until I visit, and end up embarrassed because I have to turn around and go get what I didn't know I had to pack. Now you're telling me not only is it a place, but somehow that place can itself move, to visit another place? This does not sound like an address to me. This sounds like there is way more to it than that. Me: You're enjoying this way too much. UOG: Immensely. Please continue explaining. I still have a ball of yarn that needs to be turned into a sweater. Me: Okay. So... Yes. All of what you said is correct, but you seem to be conflating the place led to by the address with the thing actually at that place. UOG: Oh, that makes sense. Alright. Where is www.example.com? What's around it? Who are it's neighbors? How is the neighborhood? Me: Okay, the address analogy is getting a little thin. It's not like you can see nearby things from any of these, except through links embedded in the thing-that-is-at-the-address. In fact, if you change even one letter of the address, you'll either not get anything, or you'll get something completely different than what you were looking for. Like you could end up on the other side of town, or in a completely different city. UOG: Oh my! Surely there is a way to tell when this has happened? Like, I should be able to see exactly where one of these lynxes you're talking drags me off to? Me: I see what you did there, and no, there is no guarantee. In fact, some people intentionally set up malicious things at addresses that are easy or frequent typos of another address, and make the page you see as similar as possible to the untypo'd address in the hopes you might disclose valuable information without noticing the mistake you made in the address. UOG: Wait... People trade in these addresses? I thought you said if I went to the same address I'd get to the same thing! What if the owner changes of an address I rely on? This seems really confusing, and like even less of an address that can be relied upon for producing consistent results. This seems like it's only a bare thread away from unravelling into a big mess. Me: Like your sweater? UOG: Shush. ...I mean, I could go on writing, but I'm willing to bet anyone should be able to recognize the problem was never the protocol, or path, or query part of a URL that caused confusion, it was the domain name itself. It completely clashes with most humans innate understandings and heuristics involved with navigating in the Real World. So ironically, they took information that could be usefully applied to giving away a fraudulent address...to only display the most readily misread bit of information with the fewest guarantees that where you're visiting is actually the same place you want to be. It only gets more confusing once you start trying to explain DNS and how they that control the DNS servers determine where requests by everyone else land, because there's actually this other address underneath it called an IP address... Honestly, I should just write a book at this point.

KronisLV 5y ago

Hmm, doesn't the latest version of Firefox show the domain in a slightly highlighted way? Wouldn't that be a good middle ground, if we wanted to make URLs easier to distinguish for the average user, without explicitly hiding that information? Example: https://i.imgur.com/KludkrC.png https://i.imgur.com/KludkrC.png

mkl 5y ago
Chrome has done something similar for a long time, but keeps subdomains the same colour as the main domain (and deemphasises the path part).

curryslapper 5y ago

isn't doing something like bolding the domain a better solution?