Hacker News Reader

What about when you buy something online or log in to a web site?

Do you not check the url before you give out your credit card details and website passwords?

From the article it sounds like Chrome is replacing the URL (which is difficult for humans to parse) with an "origin chip" that contains just the domain name. This improves on the use case you point out.

If we assume that most users do not know what a URL is then why can we assume that the information handed to them by an origin chip is any more useful to them?

Same reason as some browsers started to grey out parts of the hostname - if the only thing a user sees is "bankofamreica.com" or "bankofamerica.com.foroigs.io" they have a better chance of catching the thing that's wrong. Noise/information ratio etc..

It's actually worse in some ways. The example I'm thinking of is Google Docs, which seems to be a very effective vector for phishing.

With this change, all you'd see is "google.com" which totally seems legit for providing your username and password, without the additional form URL.

Reply on news.ycombinator.com