6 ms·

So phishers buy domains with a levenshtein distance of 1 or two. It solves one problem, but creates an entire class of users that don't understand what a URL is

So phishers buy domains with a levenshtein distance of 1 or two. It solves one problem, but creates an entire class of users that don't understand what a URL is. Who benefits? Google and search engine providers because now they can manipulate future internet users to believe that search engines are the internet. We've reverted to AOL in 1995. There is nothing more that can be productively argued about this topic. There will be analogies about how complexity is hidden in various domains (cars, computers) and how beneficial it has been and how users are happy with it. Those arguments are fine and maybe they are being made in good faith, but it doesn't change the underlying future truth: Marketing will now be changed to reflect Google keywords, not URLs. "www." and ".com" will become meaningless. Google will have put one more level of distance between what the users type in the URL and even what they click in the browser and what is reflected in the address bar.

pbz 13y ago
Well, if www and .com become meaningless then advertisers will use "type xxx yyy into you bar" instead (which goes to the search engine) or hash tags (already doing this). Then Google could come up with "associate permanent keywords with your URL" (for a small fee of course) to guarantee that those keywords won't shift under you when your Google ranking changes.
- ojii 13y ago
  I already see this happening in Japan. Rarely do I see ads include URLs, they have a search term.
  - johncoltrane 13y ago
    Which IMO is a smart idea. URLs are too often hard to remember and/or type correctly if not too long anyway.
    - cpeterso 13y ago
      Until a competitor's SEO outranks your site for those keywords or buys similar Google AdWords.
      - johncoltrane 13y ago
        Those keywords are not supposed to live long: they are used as part of marketing campaigns. But your comment is still valid. Such a strategy would be very risky in the long term.
    - ojii 13y ago
      Agreed. It also solves another problem in Japan, namely that brand names etc are usually written in Japanese letters, but URLs in ASCII (yes, I'm aware of IDN, but haven't ever seen it used). This is obviously not limited to Japan, I wouldn't be surprised if other countries used the same trick.
- ojii 13y ago
  I already see this happening in Japan. Rarely do I see ads include URLs, they have a search term.
- LukeB_UK 13y ago
  That's sort of been happening in the UK. Instead of some companies giving out a URL, they'll just say "Search xyz for more information"
- cpeterso 13y ago
  Aren't Google AdWords effectively "stable keywords for sale" today?
justinschuh 13y ago
I agree that this experiment isn't demonstrating a perfect mitigation, but it's important to appreciate that it's currently vastly easier for a phisher to permute paths and subdomain components than it is to create a convincing ETLD+1. There are various reasons for this, including less text for a phisher to work with and registration requirements for ETLD+1 domains (which means they can't be iterated and dumped as quickly, and domain owners may have a more immediate legal recourse against phishers). That's the point of experimenting on features like this, to get an idea of whether or not the they would be beneficial.
- AlisdairO 13y ago
  I don't know if such a thing already exists, but perhaps a way for a user to define 'secure urls' that go to their bank (or other important site) would be useful. Chrome could then warn when a user goes to a site that looks too similar.
- altcognito 13y ago
  What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on a login page. On the whole, supporting secure logins would be better for the internet.
  - odonnellryan 13y ago
    The problem with that is you can't detect all login forms. If you cannot detect all of them, there's a way to hide them from the browser.
  - justinschuh 13y ago
    > What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 https://twitter.com/aripalo/status/462942544007929857 The team may choose to do something like that in the end. That's really the point of experimenting with different approaches; they use them to get feedback, run user studies, and get a sense of what works best. > Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on a login page. That's actually very, very hard (as in np-hard). Chrome has heuristics for detecting login pages, but it doesn't even detect all legitimate login pages. And it's trivial for a phisher to intentionally make a page that appears exactly like a login page to the user, but will not be detected by Chrome's heuristics.
diminish 13y ago
Good summary, basically the inter web linking will become: google://keyword or better google keyword or even simply keyword
- rhizome 13y ago
  We've seen this before: http://www.musicman.com/00pic/credits.jpg http://www.musicman.com/00pic/credits.jpg
  - diminish 13y ago
    Great link... Seeing people communicate "google yourbank" and address bar becoming a search box, I thought href could be extended as an innovative technology to allow intermediated linking through a search engine.. (or Url shorteners with keywords)... But AOL already had it...
  - tricolon 13y ago
    Hah! "Edwaed Burns"
- LukeB_UK 13y ago
  Reminds me of AOL
- magicalist 13y ago
  no it wouldn't. You might put that in an ad (and as people above note, this is already happening), but this only changes what's displayed in the location bar. It would be stupid to link to another site through a web search when you can just link to the site. although, I'll note that once again, the internet is already on the case. The link you were looking for was http://lmgtfy.com/?q=keyword http://lmgtfy.com/?q=keyword
- dingaling 13y ago
  I've already experienced this with a vendor who sends me links to his own site as parameters of a Google search. e.g. google.com/search?q=http%3A%2F%2Fexample.com%2Fdemo3.html I don't even know how he generates those URLs and he didn't respond when I asked why he does it.
baddox 13y ago
There is more that can be productively argued about this topic, at least for parties who decide to not insist otherwise. URLs won't go away as long as people are still sharing websites on social networks or their own websites. I don't see the problem with not displaying the entire URL at the top of the browser window, if no actual functionality it lost. I this case, there's not even any additional clicks required to perform the same operations with URLs.
- altcognito 13y ago
  I agree with the possibility for productive debate, my comment is probably a bit too cynical. I just see a lot of redundant arguments, bad analogies and strawmen coming up soon and jumped the gun.
- lugg 13y ago
  Came here to say similar. In addition I dont see any problem. The URL bar is a redundant usability smell. Needs to be cleaned up in the fashion they have. On security, I feel its a problem sure, but teaching users about URLs is a bandaid fix, a hack and completely irrelevant to this change. You can't fix the phishing problem by showing URLs. It needs to be tackled in the proper manner and solved silently from the user. Google already does the right thing when you use them for DNS (redirects on mispelt). They also implemented blacklists of dodgy content, not ideal and doesn't scale but its a good start. Better than claiming the user is at fault. Basically if you need to claim the user is at fault your design is wrong whether you like it or not.
DanBC 13y ago
> but creates an entire class of users that don't understand what a URL is. Most people have little idea what an URL is, nor how to use an address bar. Watch a few people navigating to http://www.example.com/example.html http://www.example.com/example.html to see what they do. I personally have never understood the huge sums of money paid by some people for some URLs. I can't remember URLs; I can't remember keywords. What I can remember is some fragment of a page title, and I hope that's enough to find it in my bookmarks or in a websearch. I wish Google would just release some numbers about the numbers of people who get this stuff wrong, because learning how many people use (correctly) the + operator made that change much easier to cope with.
tobylane 13y ago
>There is nothing more that can be productively argued about this topic. Is that ever a good thing to say? The change is good. I never saw any mention of people disliking this in Mobile Safari, and it's an option power users will turn off. There's plenty of them already.

pbz 13y ago

Well, if www and .com become meaningless then advertisers will use "type xxx yyy into you bar" instead (which goes to the search engine) or hash tags (already doing this). Then Google could come up with "associate permanent keywords with your URL" (for a small fee of course) to guarantee that those keywords won't shift under you when your Google ranking changes.

ojii 13y ago
I already see this happening in Japan. Rarely do I see ads include URLs, they have a search term.
- johncoltrane 13y ago
  Which IMO is a smart idea. URLs are too often hard to remember and/or type correctly if not too long anyway.
  - cpeterso 13y ago
    Until a competitor's SEO outranks your site for those keywords or buys similar Google AdWords.
    - johncoltrane 13y ago
      Those keywords are not supposed to live long: they are used as part of marketing campaigns. But your comment is still valid. Such a strategy would be very risky in the long term.
  - ojii 13y ago
    Agreed. It also solves another problem in Japan, namely that brand names etc are usually written in Japanese letters, but URLs in ASCII (yes, I'm aware of IDN, but haven't ever seen it used). This is obviously not limited to Japan, I wouldn't be surprised if other countries used the same trick.
ojii 13y ago
I already see this happening in Japan. Rarely do I see ads include URLs, they have a search term.
LukeB_UK 13y ago
That's sort of been happening in the UK. Instead of some companies giving out a URL, they'll just say "Search xyz for more information"
cpeterso 13y ago
Aren't Google AdWords effectively "stable keywords for sale" today?

justinschuh 13y ago

I agree that this experiment isn't demonstrating a perfect mitigation, but it's important to appreciate that it's currently vastly easier for a phisher to permute paths and subdomain components than it is to create a convincing ETLD+1. There are various reasons for this, including less text for a phisher to work with and registration requirements for ETLD+1 domains (which means they can't be iterated and dumped as quickly, and domain owners may have a more immediate legal recourse against phishers). That's the point of experimenting on features like this, to get an idea of whether or not the they would be beneficial.

AlisdairO 13y ago
I don't know if such a thing already exists, but perhaps a way for a user to define 'secure urls' that go to their bank (or other important site) would be useful. Chrome could then warn when a user goes to a site that looks too similar.
altcognito 13y ago
What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 https://twitter.com/aripalo/status/462942544007929857 The issue isn't users recognizing path, it's the domain. It's also that they aren't taking special care while logging in. Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on a login page. On the whole, supporting secure logins would be better for the internet.
- odonnellryan 13y ago
  The problem with that is you can't detect all login forms. If you cannot detect all of them, there's a way to hide them from the browser.
- justinschuh 13y ago
  > What about doing something more like this: https://twitter.com/aripalo/status/462942544007929857 https://twitter.com/aripalo/status/462942544007929857 The team may choose to do something like that in the end. That's really the point of experimenting with different approaches; they use them to get feedback, run user studies, and get a sense of what works best. > Additionally, what about addressing insecure forms that fail to utilize https. Chrome is already detects login forms. So just warn users by turning the origin chip to a red background when they are on a login page. That's actually very, very hard (as in np-hard). Chrome has heuristics for detecting login pages, but it doesn't even detect all legitimate login pages. And it's trivial for a phisher to intentionally make a page that appears exactly like a login page to the user, but will not be detected by Chrome's heuristics.

diminish 13y ago

Good summary, basically the inter web linking will become: google://keyword or better google keyword or even simply keyword

rhizome 13y ago
We've seen this before: http://www.musicman.com/00pic/credits.jpg http://www.musicman.com/00pic/credits.jpg
- diminish 13y ago
  Great link... Seeing people communicate "google yourbank" and address bar becoming a search box, I thought href could be extended as an innovative technology to allow intermediated linking through a search engine.. (or Url shorteners with keywords)... But AOL already had it...
- tricolon 13y ago
  Hah! "Edwaed Burns"
LukeB_UK 13y ago
Reminds me of AOL
magicalist 13y ago
no it wouldn't. You might put that in an ad (and as people above note, this is already happening), but this only changes what's displayed in the location bar. It would be stupid to link to another site through a web search when you can just link to the site. although, I'll note that once again, the internet is already on the case. The link you were looking for was http://lmgtfy.com/?q=keyword http://lmgtfy.com/?q=keyword
dingaling 13y ago
I've already experienced this with a vendor who sends me links to his own site as parameters of a Google search. e.g. google.com/search?q=http%3A%2F%2Fexample.com%2Fdemo3.html I don't even know how he generates those URLs and he didn't respond when I asked why he does it.

baddox 13y ago

There is more that can be productively argued about this topic, at least for parties who decide to not insist otherwise. URLs won't go away as long as people are still sharing websites on social networks or their own websites. I don't see the problem with not displaying the entire URL at the top of the browser window, if no actual functionality it lost. I this case, there's not even any additional clicks required to perform the same operations with URLs.

altcognito 13y ago
I agree with the possibility for productive debate, my comment is probably a bit too cynical. I just see a lot of redundant arguments, bad analogies and strawmen coming up soon and jumped the gun.
lugg 13y ago
Came here to say similar. In addition I dont see any problem. The URL bar is a redundant usability smell. Needs to be cleaned up in the fashion they have. On security, I feel its a problem sure, but teaching users about URLs is a bandaid fix, a hack and completely irrelevant to this change. You can't fix the phishing problem by showing URLs. It needs to be tackled in the proper manner and solved silently from the user. Google already does the right thing when you use them for DNS (redirects on mispelt). They also implemented blacklists of dodgy content, not ideal and doesn't scale but its a good start. Better than claiming the user is at fault. Basically if you need to claim the user is at fault your design is wrong whether you like it or not.

DanBC 13y ago

> but creates an entire class of users that don't understand what a URL is. Most people have little idea what an URL is, nor how to use an address bar. Watch a few people navigating to http://www.example.com/example.html http://www.example.com/example.html to see what they do. I personally have never understood the huge sums of money paid by some people for some URLs. I can't remember URLs; I can't remember keywords. What I can remember is some fragment of a page title, and I hope that's enough to find it in my bookmarks or in a websearch. I wish Google would just release some numbers about the numbers of people who get this stuff wrong, because learning how many people use (correctly) the + operator made that change much easier to cope with.

tobylane 13y ago

>There is nothing more that can be productively argued about this topic. Is that ever a good thing to say? The change is good. I never saw any mention of people disliking this in Mobile Safari, and it's an option power users will turn off. There's plenty of them already.