News for hackers. Stuff that matters.
Re:Chrome 69: “www.” subdomain missing from URL by macspoofing on Thursday September 06, 2018 @02:29PM (#17928333)
>The change was made for them, not for you

Except, those same users also don't care about things in the address bar. So the change hurts the group of users that actually do care.

Re:Chrome 69: “www.” subdomain missing from URL by ehsankia on Thursday September 06, 2018 @03:12PM (#17928770)
They didn't care so far because it was so confusing. The hope is that by showing something that's user-relevant (the name of the website name and the security level), it will become more useful for the average user.

Why should a user see: https://www.wikipedia.org/wiki/Canada?utm=asdioasd&arg=j210d... when all they care about is "Wikipedia.org/wiki/Canada"?

Re:Chrome 69: “www.” subdomain missing from URL by peterwwillis on Thursday September 06, 2018 @03:30PM (#17928902)
What if the user sees "Wik1pedia.org/wiki/Canada"? Or "аррӏе.com"?

Hiding random parts of the address isn't going to make browsing the web better. The main purpose of URLs is for hyperlinks, not as a highly intuitive user interface. Users who don't know how URLs work don't care what is up there. They only care that what they are looking at is what they expect, and a way to get to where they want to go. And that's a complicated problem.

The URL bar hiding thing isn't for users, it's for Google to push Google search. That's why they attempted to remove the URL bar entirely four years ago and replace it with a search bar.

Re:Chrome 69: “www.” subdomain missing from URL by md_ on Thursday September 06, 2018 @03:55PM (#17929081)
Don’t Firefox and Safari also have a single bar for searches?

Yet neither company runs a search engine. I don’t suppose it’s possible this is just better for most users?

Re:Chrome 69: “www.” subdomain missing from URL by Multicomp on Thursday September 06, 2018 @04:28PM (#17929284)
Firefox will allow you to search via the address bar, but it still has a separate search bar to the right by default.
Re:Chrome 69: “www.” subdomain missing from URL by qu4z-2 on Thursday September 06, 2018 @06:28PM (#17930196)
Also, if you go into about:config and turn off keyword.enabled, the address bar will no longer search.

It's very useful if you don't want to Google internal/client URLs just because you accidentally copied a space at the start or the hostname doesn't resolve in your current environment, etc.

Re:Chrome 69: “www.” subdomain missing from URL by joshuamorton on Thursday September 06, 2018 @04:34PM (#17929335)
Re:Chrome 69: “www.” subdomain missing from URL by r3bl on Thursday September 06, 2018 @05:22PM (#17929667)
It still exists, but the default changed.

Now you can go to menu -> Customize and drag it where you want.

Re:Chrome 69: “www.” subdomain missing from URL by ehsankia on Saturday September 08, 2018 @12:29AM (#17939413)
That has nothing to do my argument. Just because people can't detect homoglyphs doesn't mean we should keep overloaded urls and shouldn't strive to make them more user friendly.

There's still value to be gained from having easily readable urls.

Re:Chrome 69: “www.” subdomain missing from URL by UncleMeat on Thursday September 06, 2018 @05:55PM (#17929958)
Users don't see that.

Expecting users to use the URL bar to detect phishing via homoglyphs is insanity.

Re:Chrome 69: “www.” subdomain missing from URL by peterwwillis on Friday September 07, 2018 @06:06AM (#17933077)
Right. So messing with the URL bar is pointless. If people actually don't like it, get rid of it, but provide some other means to establish authenticity of what you're looking at.
Re:Chrome 69: “www.” subdomain missing from URL by type0 on Thursday September 06, 2018 @03:27PM (#17928875)
http://www.example.com

https://www.example.com

http://example.com

https://example.com

do not have to be the same website and there are cases where it isn't the same site!

Which site you visit does matter and not just for internet banking. If it becomes that easy if we hide things maybe we should hide the half of the traffic lights as well.

Re:Chrome 69: “www.” subdomain missing from URL by ehsankia on Saturday September 08, 2018 @12:30AM (#17939417)
Those examples don't prove anything. First off, the http ones would appear different, they would have no lock. And 99.999999% of websites don't have a different www. and non-www. page. Showing www. for that 1 in a billion site, for that 1 in a million user, is insane.
Re:Chrome 69: “www.” subdomain missing from URL by freehunter on Thursday September 06, 2018 @03:23PM (#17928852)
Because arguments aren't always useless like in your example. Might as well just do away with the whole URL bar and just have a green checkmark if Chrome thinks it's the site you want.

I mean, why should a user see "Wikipedia.org/wiki/Canada" when all they care about is "This is the Wikipedia Page for Canada"?

Re:Chrome 69: “www.” subdomain missing from URL by md_ on Thursday September 06, 2018 @03:59PM (#17929100)
I know you’re being sarcastic, but if chrome could, with perfect accuracy, indicate if this was “the site you want”, why not do away with the url?

Mind you, I’m not suggesting to do away with linking, as some rando suggested this implies. (While chrome doesn’t show the protocol prefix, it still copies the prefix when you copy the url, so imagine a similar ui.) But for most users, wouldn’t a ui that shows “server identity” in some more user-coherent way be what they want?

In particular, do subdomains help or hurt phishing detection?

Re:Chrome 69: “www.” subdomain missing from URL by scrollaway on Thursday September 06, 2018 @05:02PM (#17929517)
You're making a hypothetical based on "with perfect accuracy"... but the much simpler change here (www vs. no www) is not done "with perfect accuracy", as clearly outlined by a bunch of comments in this thread.
Re:Chrome 69: “www.” subdomain missing from URL by ehsankia on Saturday September 08, 2018 @12:34AM (#17939427)
So you're saying we should show all users www., just because that one site in a billion that shows a different non-www. page, for that one user in a million that would even notice that difference? Chrome is a browser for the mainstream people. The feature you're asking for is for power users and extreme edge cases.
Re:Chrome 69: “www.” subdomain missing from URL by freehunter on Thursday September 06, 2018 @04:33PM (#17929329)
If we could, I'd be all for it. Have an option that says "show URL bar or not" and by default hide the URL bar, optionally show the whole thing. Especially on space-constrained devices like cell phones where every pixel counts. Just show the page's title.

I think we're a long way away from that ideal, though, and some web pages may not be designed with this ideal in mind.

Re:Chrome 69: “www.” subdomain missing from URL by majewsky on Thursday September 06, 2018 @03:33PM (#17928935)
Because there is a huge difference between those two:

  https://en.wikipedia.org/wiki/Canada
  https://fr.wikipedia.org/wiki/Canada
Re:Chrome 69: “www.” subdomain missing from URL by vntok on Thursday September 06, 2018 @04:29PM (#17929294)
If the browser absolutely 100% of the time knew that difference and showed "Wikipedia FR > Canada", wouldn't it be much simpler for the average user?

The browser could even show specialized UI such as "FR" as a clickable dropdown menu to allow users to switch languages. Chrome already does this for searching a single website through the address bar (type domain.com TAB)

Basically these changes are not thought for you. You are not representative of the average Web user.

Re:Chrome 69: “www.” subdomain missing from URL by polaritron on Thursday September 06, 2018 @07:07PM (#17930423)
No, it's really important to retain all those dots and slashes. This is not sarcasm. I'm being completely serious when I say this. It's really easy notation, and the differentiation of context for dots, slashes, question marks and hashtags is really useful.

  Wikipedia FR > Canada
I look at that angle bracket with the white space, and I get chills. And I'm not even drawing attention to that oh-so-glaring omission of the /wiki/ context. Truly horrifying.

Repeat. This is not sarcasm.

Dark roads ahead, friends.

Re:Chrome 69: “www.” subdomain missing from URL by Lyrkan on Thursday September 06, 2018 @05:11PM (#17929582)
Hiding the URL would be a terrible idea, no matter how much "simpler" it would be for the average user: it would either only be enabled for a handful of websites chosen by Google (which would mean having an inconsistent UI) or create a lot of security issues (what if someone creates a website and manages to also display "Wikipedia FR" with a similar layout?).
Re:Chrome 69: “www.” subdomain missing from URL by px1999 on Thursday September 06, 2018 @04:52PM (#17929449)
Maybe it could show "Canada - Wikipedia" like the page authors intended as a title. Maybe if the page authors want to have links between languages, they could code that in a standard markup language themselves.

These aren't decisions for a useragent to make, and there aren't enough browsers out there that people have a reasonable choice.

Bastardising the url isn't a solution to anything, it's a step towards something that Google, not users, want (in making AMP "trivial").

Re:Chrome 69: “www.” subdomain missing from URL by vntok on Thursday September 06, 2018 @05:11PM (#17929578)
A useragent is literally a user's agent, it is supposed to help its user browse their target website. It is not supposed to help the target website show things to the user.
Re:Chrome 69: “www.” subdomain missing from URL by ryandrake on Thursday September 06, 2018 @03:28PM (#17928882)
I wonder if there is any research or evidence that users actually find “www.” confusing enough to go through the trouble of removing it.
Re:Chrome 69: “www.” subdomain missing from URL by nqzero on Thursday September 06, 2018 @03:17PM (#17928810)
the only thing you've changed is now those 99.9% users can't even find the information they need to ask the .1% for help

great work

Re:Chrome 69: “www.” subdomain missing from URL by eponeponepon on Thursday September 06, 2018 @03:51PM (#17929051)
All they actually care about is "Wikipedia - Canada". Which is right there on the page.
Re:Chrome 69: “www.” subdomain missing from URL by nkkollaw on Thursday September 06, 2018 @03:19PM (#17928816)
According to Apple, they care about "wikipedia.org", only.
Re:Chrome 69: “www.” subdomain missing from URL by softawre on Thursday September 06, 2018 @03:25PM (#17928860)
I like how HN cuts off the end of that url.
Re:Chrome 69: “www.” subdomain missing from URL by always_good on Thursday September 06, 2018 @03:41PM (#17928997)
It matters because deep-linking is possible on the web.

Hiding it just seems like a trivial UI matter that makes things slightly more obnoxious when you do care.

I'd be surprised if only showing the domain vs domain+path made any difference on phishing results.

I don't think these little tricks do much for the user. For example, browsers now highlight https websites with green in the url bar and show a little lock icon. But how is that actionable information for the user? To what extent does that mean you can trust that website, and how does the average person interpret it? Phishing websites use https, too.

I would avoid stealing any pages from Safari's UI. That browser doesn't even show favicons on browser tabs to let you quickly distinguish them.