News for hackers. Stuff that matters.
Re:Google Safe Browsing is blocking small Mastodon servers by olliej on Wednesday November 09, 2022 @01:50AM (#33528256)
Except [0] has been demonstrated to actually be more useful for average users, as it hides parts of the url that are not actually relevant. I don't know what google's current UI for it is, but in safari by default https:// is not shown. Instead if you visit a http: site you get a completely different UI "not secure - example.com".

The reason for these UI changes is very simple: signaling secure vs insecure via a single character in a string that is meaningless to most people makes it essentially useless. Similarly making "secure" websites get a padlock is not helpful - it's essentially the same as a car engine light, except the engine light is surrounded by a dozen other lights, and it turns off when there's a problem. Unending amounts of research show that that kind of design means people will not notice problems.

This is not to say Google is a shining example of privacy engineering (see their core business model), but you're being incredibly dismissive of the work that their chrome and browser privacy engineering teams do.

Re:Google Safe Browsing is blocking small Mastodon servers by amatecha on Wednesday November 09, 2022 @02:16AM (#33528364)
I am definitely dismissive of the benefits of work that obfuscates or conceals the most concrete piece of information I require to know what site I am on: the complete URL, including schema, that I have been looking at on every single web page I visit since the early 90's.

IMO when a browser vendor does something like this, I'm not in a rush to sit there and read all their blog posts and give huge consideration to yet another megacorp imposing their will upon me. I just don't want my URL hidden, and I will definitely turn off features like this where possible. (n.b. I don't use Chrome, so its irrelevant for me)

Interesting. http "not secure", but I bet every piece of malware delivered to a user's machine via browser exploit was delivered on an https URL...

BTW, you make some assertions about the feature being more useful for average users -- can you provide any links/documents about this? I am very skeptical, though you are under no obligation to convince me (don't spend the time finding link(s) unless you specifically feel like it). I'd be curious, because I even feel doubtful that there's any solid measurement indicating hiding part of the URL has actually benefited anyone.