It was previously possible for an attacker, especially a selective one to impersonate the domain of a major provider like Paypal or Dropbox in the display addre

It was previously possible for an attacker, especially a selective one to impersonate the domain of a major provider like Paypal or Dropbox in the display address. I think the fact this is no longer possible is a good thing. Phishing has got a lot more aggressive, and obviously if these measures were not being deployed the situation would simply be a lot worse.