Skip to content
Hallway
0:00 / 0:00

#url#phishing#chrome

Humans can't read URLs. How can we fix it? - HTTP 203

Chrome for Developers

822K subscribers • 20 videos on Hallway

YouTube
  • Recommended by 3 people: 3 on Hacker News.
  • Presented by Jake Archibald, Google Chrome Developer
  • Made by the vendor. The company whose product it covers made or sponsored it.
  • May be out of date. Uploaded 6 years ago, in an area where tools change fast.
  • An opinion. It argues one side of a question engineers disagree on.

Intermediate. Assumes working knowledge.

59K views6 years ago3 recommendations

Web developmentSecurityHow browsers workWeb and application security

Jake Archibald explains why URLs are difficult for humans to read and discusses how browsers can improve security by redesigning the address bar.

In this episode, Jake makes the case that URLs are impossible for humans to interpret, especially when it comes to security. What are browsers doing today to overcome that? And, is there a better way? Subscribe to Google Chrome Developers here → goo.gle/ChromeDevs Also, if you enjoyed this, you might like the HTTP203 podcast! → goo.gle/2M5Fpcv Whoa, thanks for reading the description right to the end! Why not post a comment saying you spotted the easter egg in this episode. There isn't one of course, but it'll confuse everyone who didn't read the description.

Why it's here

3 people recommend this, 1 disputes it

What people say. Recommended for its clear explanation of the security and usability challenges of URLs and the reasoning behind hiding parts of them.

Orochikakuon Hacker News • Recommends

On “Google adds experimental setting to hide full URLs in Chrome 85 address bar”

A couple of Google Chrome devs talk about the issues surrounding the readability of urls and their security implications and possible solutions in an episode of their podcast0. I think they make a compelling argument for hiding most of the url in part to prevent phishing however I do think they should allow this behaviour to be toggled via a flag. 0 link to this video
View on Hacker News

AshleysBrainon Hacker News • Recommends

On “Google adds experimental setting to hide full URLs in Chrome 85 address bar”

Reading URLs is actually really hard - even for experts. This video covers the problems well: link to this video This is bad for web security, since the registerable domain is the part you have to trust, but it's surprisingly difficult to figure out that part. However I feel a bit uneasy about this since URLs are important and tell you where you are on a website. I prefer Firefox's approach which emphasises the registerable domain in the URL bar and fades out the rest of it, making it easier to spot the important bit. However it's still quite subtle - it could do with being a clearer distinction.
View on Hacker News

davidmurdochon Hacker News • Recommends

On “Google resumes its attack on the URL bar, hides full addresses on Chrome 86”

Jake Archibald (a Googler) presents some decent points on this on the HTTP 203 podcast: link to this video I still don't agree with the removal of URLs, but I do still recommend watching the entire video if you want to get more perspective on the issue (beyond just the conspiracy theories about AMP and control).
View on Hacker News

benatkinon Hacker News • Disputes

On “Google’s nightmare “Web Integrity API” wants a DRM gatekeeper for the web”

Why did Google select someone unknown to announce this? It's also the second time I've noticed Google had someone the UK introduce an unpopular proposal to Chrome. The other one was removing the URL from the address bar (accusing the author of You Don't Know JS of being "Trump-like" for how he disagreed with him in the process). link to this video link link Is there a special ops team? Of the FAAMGs my favorite is Google, but this makes me reconsider my position.
View on Hacker News

dfabulichon Hacker News • Mentions

On “Humans can't read URLs. How can we fix it?”

In this video, a Googler here proposes adding the "ETLD+1" part of the domain name as a "chip" where the extended-validation certificate name used to be. So this link: link Would look like this in the browser: jakearchibald.github.io | link The proposal appears at 16:45 link to this video
View on Hacker News

felixfbeckeron Hacker News • Mentions

On “Google adds experimental setting to hide full URLs in Chrome 85 address bar”

It is, there’s a long special list for domains that host arbitrary subdomains, GitHub pages is one of them. It’s explained well in link to this video
View on Hacker News

jaffathecakeon Hacker News • Mentions

On “Chrome abandons 'simplified domain experiment' in omnibar”

Yes. Years. I think a URL bar that sticks to the security relevent parts is a good idea. It's hard for even experienced users to figure that stuff out. I tried to explain it here link to this video
View on Hacker News