Hacker News Reader

Comment by bambax | Hacker News Reader

> phishing is a very big problem

Is it? What are the numbers?

So many annoying things are done in the name of "security" without much justification (both online and in real life); Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help folks who can't be bothered to read it?

Another comment suggests "source code highlighting" for the url, where the actual domain would be emphasized while still showing the whole url: what are your thoughts on this?

(Disclaimer: I have not tried the Chrome version in question so I very well may not know what I'm complaining about.)

View on HN

> Is it? What are the numbers?

Providing more detailed background and better numbers on phishing sounds like a good idea. However, this is an experiment that is not on track to ship in any version of Chrome, so I wouldn't consider it a gating criteria for continuing to experiment.

> Chrome removed the protocol for no reason and Firefox felt obliged to do the same, and now we're removing the whole url just to help folks who can't be bothered to read it?

The decision to not display the HTTP scheme was not related to security (and it wasn't to my personal liking). However, it was done in such a way that it was effectively security neutral.

> Another comment suggests "source code highlighting" for the url, where the actual domain would be emphasized while still showing the whole url: what are your thoughts on this?

As I commented elsewhere, Chrome has been highlighting the origin since its inception. However, phishing is still a serious problem, so the team that's working on this is investigating clearer indicators like the ones in this experiment.

So you think crackers(>hackers) and people with bad intention will be unable to see the URLs and won't be able to do phishing easily.

So, through obscurity you will achieve security.

Edit: or you expect users to notice phishing attempts more clearly by only displaying the domain name?

I am not sure the "security/obscurity" logic applies here.

It's all just GUI change, nothing is really obscured (as in not accessible). It's just more radically highlighted.

It's the latter. By only displaying the domain name users are more likely to notice a scam domain name, e.g. the Halifax.co.uk case in the parent blog post.

Thanks for understanding former or latter iquestion which I wrote at once:-)

I'm not sure you quite understand!

The intent isn't to hide the URL from technical people like scammers... Its to hide it from nontechnical people. It's easier to train your grandparents to look at a shortened URL containing just the domain name, and having them verify that is what they expect - as all the distracting bits of the URL are gone...

(Also - "crackers" refers to a very different group of people....)

If black vs. light grey is your concept of "highlighting" then I have to tell that I didn't even notice the behavior until today. Maybe you should try actual color before removing functionally?

Seconded. The current situation doesn't appear to warrant the term "highlighting"...

I feel I'm fairly immune to traditional phishing because I never click a URL in an email. If namecheap sends me an email saying one of my domain names is about to expire, I don't use their "Renew Now" link I go to "namecheap.com" (not hard to type), log in, and renew the name. Banks and other organizations that send long complicated links in emails and encourage people to click them are part of the reason phishing is possible. These emails should look like:

Dear John Doe,

An automatic payment has been made from your checking account:

04-May-2014 $125.00 to Big Energy Utility Corp

For more details, please log on to your online banking account and click the "Recent Transactions" tab.

There is no need for hyperlinks in any of that.

plus it forces web sites to be designed in such a way to easily locate what you need, e.g. "recent transactions" shouldn't be buried deeply in the navigation tree.

Yeah, part of me wonders how bad it would be / what would break if email clients banned outside links (e.g. beyond fragments in the email). My suspicion is that the only useful use of a link is a confirmation email which have other potential implementations...

It could be interesting if Gmail did the Chrome experiment in email links in a popover, by displaying the domain of a link...

This would effectively break email verification, which would be pretty bad.

    To verify your email, please login at SiteYouHaveJustRegisteredAt
    and enter the following information:

    User ID: 1234
    Verification code: 12345678

>where the actual domain would be emphasized while still showing the whole url

This is already the case in Firefox. I don't know how long they've been doing it, but I think it's the perfect compromise.

Reply on news.ycombinator.com