Google resumes its attack on the URL bar, hides full addresses on Chrome 86

Re:Google resumes its attack on the URL bar, hides full addr... by badwolf on Friday August 14, 2020 @10:31AM (#24158409)

My first thought when reading this was relief... For my mother.

I've spent most of my adult life trying to teach my parents to look at the address bar to make sure they're on bankofamerica.com and not some random phishing domain. That kind of falls apart though when it's... bankofamerica.comm.phishingdom.com/{random filler}/bankofamerica/user/login

HN users are fantastic at thinking all technologies should revolve around their niche use case.

[ Parent | on HN ]

Re:Google resumes its attack on the URL bar, hides full addr... by dgb23 on Friday August 14, 2020 @01:09PM (#24160461)

The root domain is highlighted in FF. This must be enough for visual testing.

If you want a more reliable approach then you need to work with a whitelist and clear warnings.

[ Parent | on HN ]

Re:Google resumes its attack on the URL bar, hides full addr... by summerlight on Friday August 14, 2020 @01:57PM (#24161048)

I wouldn't assert it without strong evidence. This URL comprehension problem is probably more complex than what people usually think. There are a number of studies about this issue, if you're interested.

https://storage.googleapis.com/pub-tools-public-publication-... https://kumarde.com/papers/urls.pdf

[ Parent | on HN ]

Re:Google resumes its attack on the URL bar, hides full addr... by dgb23 on Friday August 14, 2020 @02:13PM (#24161297)

Thank you for those! Side question:

I don't have a formal education in CS, but I really enjoy reading papers on programming (languages), architecture, data-engineering and web related things among others, especially when they have a practical focus/impact.

Is there a good way for me to find or rather discover resources like these?

[ Parent | on HN ]

Re:Google resumes its attack on the URL bar, hides full addr... by automatoney on Friday August 14, 2020 @03:10PM (#24162021)

Not sure about filtering for practical focus/impact but https://arxiv.org/ is an amazingly useful and informative repository of papers that you might like. Also google scholar is good, but more general.

[ Parent | on HN ]

Re:Google resumes its attack on the URL bar, hides full addr... by Corrado on Saturday August 15, 2020 @03:48AM (#24166874)

> The root domain is highlighted in FF. This must be enough for visual testing.

I've been using Firefox for years and never realized this. Looking up at the top of my browser, I can see that "ycombinator.com" is highlighted and the rest of the URL is a darker grey. To me, this seems like a good compromise; you still get the full URL but the important parts stand out a bit more.

[ Parent | on HN ]

Re:Google resumes its attack on the URL bar, hides full addr... by donor20 on Friday August 14, 2020 @08:07PM (#24164709)

Exactly - also if you do any penetration testing of your staff side - the key to get something through is have the name of the company it seems anywhere in the URL. Literally - lkjljkdfskjfsd.com/bankofamerica/securelogin.do etc.

Part of the issue I've noticed is some sites actually do outsource things to other sites (microsoft has a lot of redirects on logins so you used to end up on passport.com I think to login, and then to something with azure, then office... etc). Combine this with subdomains and trailing urls and internationalization efforts and you are in trouble.

This must be just because of how we scan / read things? Ie, a quick cross check. A lot of people maybe don't parse all the elements properly (,.:?& etc).

The other issue - let's say just 2-5% of chrome users are confused. That still is a HUGE number that are confused.

[ Parent | on HN ]

Re:Google resumes its attack on the URL bar, hides full addr... by p7hwfizeONj on Friday August 14, 2020 @12:42PM (#24160127)

It looks like non-trivial subdomains will still appear and those seem to me to be the most problematic.

[ Parent | on HN ]