3 ms·
> Is it? What are the numbers? Providing more detailed background and better numbers on phishing sounds like a good idea. However, this is an experiment that i
by justinschuh 12y ago
> Is it? What are the numbers?
Providing more detailed background and better numbers on phishing sounds like a good idea. However, this is an experiment that is not on track to ship in any version of Chrome, so I wouldn't consider it a gating criteria for continuing to experiment.
> Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help folks who can't be bothered to read it?
The decision to not display the HTTP scheme was not related to security (and it wasn't to my personal liking). However, it was done in such a way that it was effectively security neutral.
> Another comment suggests "source code highlighting" for the url, where the actual domain would be emphasized while still showing the whole url: what are your thoughts on this?
As I commented elsewhere, Chrome has been highlighting the origin since its inception. However, phishing is still a serious problem, so the team that's working on this is investigating clearer indicators like the ones in this experiment.
- diminish 12y agoSo you think crackers(>hackers) and people with bad intention will be unable to see the URLs and won't be able to do phishing easily. So, through obscurity you will achieve security. Edit: or you expect users to notice phishing attempts more clearly by only displaying the domain name?
- runn1ng 12y agoI am not sure the "security/obscurity" logic applies here. It's all just GUI change, nothing is really obscured (as in not accessible). It's just more radically highlighted.
- opium_tea 12y agoIt's the latter. By only displaying the domain name users are more likely to notice a scam domain name, e.g. the Halifax.co.uk case in the parent blog post.
- diminish 12y agoThanks for understanding former or latter iquestion which I wrote at once:-)
- kiallmacinnes 12y agoI'm not sure you quite understand! The intent isn't to hide the URL from technical people like scammers... Its to hide it from nontechnical people. It's easier to train your grandparents to look at a shortened URL containing just the domain name, and having them verify that is what they expect - as all the distracting bits of the URL are gone... (Also - "crackers" refers to a very different group of people....)
- tl 12y agoIf black vs. light grey is your concept of "highlighting" then I have to tell that I didn't even notice the behavior until today. Maybe you should try actual color before removing functionally?
- bambax 12y agoSeconded. The current situation doesn't appear to warrant the term "highlighting"...