Google Takes Its First Steps Toward Killing the URL

https://www.wired.com/story/google-chrome-kill-url-first-steps/

by glassworm • 7 years ago

417 252 7 years ago

mooman219• 7 years ago

I'm a bit confused on when the URL checking is applied. Is the browser going to maintain a list of "good" domains and validate against that? If so then that'll need a lot of maintenance. Getting yourself on that list would need to go through some process that probably isn't transparent. If your legitimate website is too similar to one on the known "good" list, then it'll also probably be a process to get that resolved too all while you're losing visitors. If you attempt to automate this then there's a new risk that someone gets a malicious site in.

wmf2• 7 years ago

The existing safe browsing system is more like a blacklist and it sounds like this new system will be similar. https://blog.chromium.org/2012/01/all-about-safe-browsing.ht... But if the machine learning model is small enough one could imagine building it into the browser.

move-on-by4• 7 years ago

I’m against chrome taking always the URL. While they make points about security and dumb users, I don’t believe they have altruistic motives.

An issue with AMP is the terrible URLs- because they are hosted by google. Once Chrome no longer has URLs, then Chrome gets to decide what name to show you in the address bar - potentially a name that has very little to do with the actual location of the document. Maybe I’m being a bit extreme or pessimistic, but do not believe this is a good change for the web, and I don’t think Google can be trusted to be the stewards of the internet.

jeffjose2• 7 years ago

The AMP team is working on the exact opposite, which is adopting Web Packaging [1] that fixes the URL issue you are describing.

https://amphtml.wordpress.com/2018/11/13/developer-preview-o...

[1] https://github.com/WICG/webpackage

sodosopa• 7 years ago

AMP has it's own issues:

https://www.polemicdigital.com/google-amp-go-to-hell/

dane-pgp• 7 years ago

As a nice side effect of Google pushing Web Packaging, we get one step closer to having web apps that are signed with an offline key and served with a clear version number.

This would mean you could have at least a TOFU security model, where a web app that you trust can't be replaced (without you knowing) by an insecure version you haven't seen before.

Add some binary transparency [1] logging on top of that, and it might be possible to make browser-based JavaScript crypto almost as secure as the equivalent desktop app.

[1] https://wiki.mozilla.org/Security/Binary_Transparency

clhodapp2• 7 years ago

From the parent:

... then Chrome gets to decide what name to show you in the address bar - potentially a name that has very little to do with the actual location of the document

That doesn't seem to be the opposite of what the parent post is describing, it seems to be an implementation of it.

ken4• 7 years ago

They don't say anything about "dumb users", and I wish the conversation around this didn't even use that phrase. Hardhats aren't just for clumsy people, seatbelts aren't just for bad drivers, and memory protection isn't just for careless programmers. There's no shame in engineering a situation to maximize safety for the people who will use it.

There's a whole lot of smart people who like static typing for the safety benefits it brings to their programming. Web browsers are the front lines: where one click on a stringly-typed reference can cause unknown third-party code to run on your computer. You are protected only by your human ability to spot the visual difference between two strings, one of which is constructed by someone trying their hardest to trick you. If you advocate for type safety within software, you should also advocate for a better system than URIs.

SllX2• 7 years ago

Or advocate for disabling the ability for your web browser to run 3rd party code just by clicking a link.

Google is not trustworthy because between Chrome and Search they have too much of a stake in the eventual outcome of anything that could replace URLs. Any system that eventually does replace URIs should be able to tell me at a glance: is it http, ftp or a local file? Is there a TLS cert? What is the domain of the server I am accessing? Approximately where in the site directory am I?

I simply don’t trust browsers or sites which try to obscure what is actually useful information because some UX guru told them it was unnecessary. If anything, I want URLs with even more information. Which version of “http” is in use would be a nice start at this point.

gear54rus• 7 years ago

you are actually protected by the browser's sandbox... this analogy does not address the fact that you add another party that tricks you with the removal of url and that is Google

jessriedel2• 7 years ago

They don't say anything about "dumb users", and I wish the conversation around this didn't even use that phrase. Hardhats aren't just for clumsy people, seatbelts aren't just for bad drivers, and memory protection isn't just for careless programmers

There are frequently tradeoffs between safety and flexibility/performance/value, and the proper tradeoff to be made can depend on the sophistication of the user. So are you just upset that that a derisive word was used, or are you arguing that in this particular case the proper trade-off is independent of user sophistication?

elihu• 7 years ago

If you advocate for type safety within software, you should also advocate for a better system than URIs.

Well, maybe. Before I advocate for a better system than URIs, I'd like to be convinced that this is a problem that can be solved in a satisfactory way and that the solution doesn't involve ceding control over Internet names to some unaccountable party.

NicoJuicy4• 7 years ago

Hiding the URL has nothing to do with seatbelts on a car.

boomlinde3• 7 years ago

Hardhats aren't just for clumsy people, seatbelts aren't just for bad drivers, and memory protection isn't just for careless programmers. There's no shame in engineering a situation to maximize safety for the people who will use it.

There's an inherent bias in the choice of analogy. There are many potential metaphors that aren't as favorable as hardhats or seat belts. How about a leash or blinders?

There's a whole lot of smart people who like static typing for the safety benefits it brings to their programming. Web browsers are the front lines: where one click on a stringly-typed reference can cause unknown third-party code to run on your computer.

URIs have a rather well defined type and you can easily detect a malformed URI. The problem Google seems to intend to address, and the way they intend to address it, has nothing to do with the type of the URI but ultimately how its value should be conveyed and heuristic restrictions on what forms the values may take. This leads to situations where valid URIs are treated as invalid, based on arbitrary heuristics, not a tightening of the type of value a URI encodes.

The more apparent problem, from your description, seems to be that websites can at all use your computer to execute arbitrary third-party code. Addressing this by vaguely limiting what URIs you may access is a weird way not to take the bull by the horns. To somehow hide information that is part of the URI to make it more clear what resource the URI represent is just ass-backwards.

ledriveby• 7 years ago

What does AMP have to do with anything? The fine article is about flagging potential URL homograph attacks. It's a reasonable thing for a browser to do, since those attacks are incredibly hard to spot.

I don't know why Wired clickbaited the headline like this.

geofft5• 7 years ago

WIRED published a (relatively positive!) article last fall entitled "Google Wants to Kill the URL": https://www.wired.com/story/google-wants-to-kill-the-url/ I'm interpreting the title as a reference to that.

And the relevance is that AMP shows its own fake-URL bar, and Google could choose to "kill the URL" by trusting https://www.google.com/amp/ with not-URL overrides. (But, they could do that presently and trust themselves with URL overrides.)

ehsankia2• 7 years ago

They've been running wild with "KILLING THE URL" for some time now. Put it right next to "Google murdering ad blockers" and "Google decapitating hangouts classic".

Is there any unbiased article out there going over the proposals?

gsich2• 7 years ago

The reasonable thing would be to display the real domain, and the punycode one, in the same bar. Then you can at least detect some homograph attacks. Or possible use a monospace font for the URL bar. So that 0 with a dash and O are actually visible at first glance.

hkai• 7 years ago

Eventually they just want to whitelist the "good" sites and make it harder to access small independent sites, further centralizing the web and getting more tools to censor content.

Imagine that they would make it hard to access a small competitor to Gmail or restrict a website that has news they don't like.

mrhappyunhappy2• 7 years ago

Introducing “trusted content providers”. Default opt in, opt out only if you acknowledge you’ll be exposed to phishing (red scary screen).

sh87• 7 years ago

Outright restricting would seem unlikely given the anti-trust scene they are having to put up against. But, I can totally imagine them introducing an extra step under the garb of "protecting" users like a dialog, a popup coupled with a red banner on the URL is enough to discourage significant number of people from visiting the target website.

tyingq• 7 years ago

Anyone remember "AOL keywords"? You would pay AOL to make your content discoverable. And some keywords were reserved only for AOL use.

geofft5• 7 years ago

I think that Google is a big organization and the fact that the search team thinks that AMP is a good idea is not necessarily evidence that the Chrome team does - or even if they do, that they'd want to let AMP be considered as some origin other than google.com. For instance:

- Google's phishing quiz https://phishingquiz.withgoogle.com has a question where the right answer is that a URL that starts with google.com is actually an AMP page for a URL shortener that sends you to a Google login phishing page.

- The Chrome team's document about displaying URLs https://chromium.googlesource.com/chromium/src/+/master/docs... is at best neutral on the case where "a domain owner is willing to supply content from a third-party within their own address space," calling out AMP as a specific example of this, and pointing out (in the section "A Caveat on Security Sensitive Surfaces") that anything in the renderable area of the webpage is below the "line of death" and untrustworthy.

- Google search once penalized Google Chrome for breaking SEO rules. https://searchengineland.com/google-chrome-page-will-have-pa...

- Also I think I've seen Chrome developers tweet things that are less-than-happy about AMP, but I can't find them any more.

(That said, I do agree that we shouldn't be trusting Google to be stewards of the internet - and that is a huge part of the value Firefox provides, honestly - just that I think in this regard they're unlikely to abuse the trust.)

bad_user2• 7 years ago

In a conflict of ideas between the Search team and the Chrome team, I'm pretty sure it's irrelevant what the Chrome team wants.

riffraff• 7 years ago

While Google is certainly not monolithic we have previous evidence of really bad ideas being pushed across the entire product line (Google+, for one)

SECProto• 7 years ago

Google's phishing quiz https://phishingquiz.withgoogle.com

I don't trust this URL, so I won't click on it/do the quiz. Does that mean I pass?

wutbrodo• 7 years ago

I commend you for taking the complaint seriously, but Google Derangement Syndrome is epidemic on HN. Any conspiracy theory that reaches even Pizzagate levels of plausibility gets upvoted, including dross like the above.

wmf2• 7 years ago

a name that has very little to do with the actual location of the document

I'm sorry to tell you that you've already been tricked — not once but thousands of times. You think you're browsing wired.com? Wake up Neo, you're really on Fastly. Every major site uses CDNs. Once AMP uses Web Packaging to show the URL of the original site instead of google.com, it will be... no worse than any other CDN.

3xblah• 7 years ago

It is true. The only way you will see where you are is to observe DNS.

What the browser authors like Google are doing is further hiding DNS from the user. Many years ago Firefox was already hiding and highlighting parts of urls in the address bars to "protect" users. It will only get worse.

I often navigate by first doing automated lookup using only non-recursive queries, then storing the address permanently until it changes (rarely does), and finally after I have the needed address, navigating to the url. I see every DNS answer, and thus I can see all CDN use.

Fastly has really emerged over recent years and is very popular among sites appearing on HN.

CDNs are popular but not all sites on HN or elsewhere use them. There are still many, many sites that do not use CDN's nor share IP addresses with other sites.

move-on-by4• 7 years ago

Every major site uses CDNs. Once AMP uses Web Packaging to show the URL of the original site instead of google.com

I disagree. Although wired.com might be served by fastly, fastly is not in the URL scheme and is treated as a 3rd party. There are a lot of browser restrictions on 3rd parties. Having fastly become a first party would definitely be different in terms of browser restrictions

samstave3• 7 years ago

I am of the opinion that the reality behind AMP is much more insidious than security and dumb user mitigation.

I believe that AMP is the mortar that builds the solid connection between users and ALL their activities and views and logins and accounts and handles across their browsing behavior.

Which links you clicked, not matter what site you are on or who you are logged in as. It seems to completely dissolve any anonymity, period.

tareqak• 7 years ago

Actually, you totally have a point. Consider the case of China and its Great Firewall. If you can control the URL and separate it from the content, then you can control what people see on yet another level e.g. we aren't blocking what Wikipedia says about the Tienanmen Square massacre this is what that URL actually says. tl;dr gaslighting / rewriting history on a mass scale if you can't use the URL to get to particular server.

taneq2• 7 years ago

As always with Google, there are two outcomes. An improvement to some engineering or social issue, and an increase in the amount of data flowing into Google from the rest of the world.

Of course the latter is pure coincidence, but it's always there.

LoSboccacc2• 7 years ago

I'm happy this community is coming to its senses. When I voiced this concerns ten months ago the downvotes were in the double digit.

most of the contention was that people was able to 'self-host' amp, as if that was going to happen for anything but few selected cases.

the solid connection between users and ALL their activities [] seems to completely dissolve any anonymity, period.

and wait to hear what cloudflare does!

We collect End Users’ information when they use our Customers’ websites, web applications, and APIs. This information may include but is not limited to IP addresses, system configuration information, and other information about traffic to and from Customers’ websites

throwaway2048• 7 years ago

Reminds me of chromium dev discussions about severely limiting ad-blockers, for your safety of course, and only for the users.

Not for Google's massive benefit.

princekolt• 7 years ago

I think the only hope would be pushing more people to drop Chrome and start using different browsers. This would reduce the leverage Google has to bully other browsers to follow them.

This might sound impossible today, but 10 years ago we'd be saying the same thing about IE.

mancerayder3• 7 years ago

Firefox has become increasingly usable. I've transitioned to it and DuckDuckGo, using Chrome only for the Google business apps. On mobile on Android it gets mad and freez-y if you open too many tabs, and on desktop it gets angry and pause-y if you're behind a proxy, but otherwise it's pretty decent.

cm2187• 7 years ago

It's the same argument about file hierarchies. Apple doesn't think users should even be aware that there is a file hierarchy (iOS). I don't think users are confused at all by files and folders. But somehow Apples seems to think they are.

What I do not understand is that the percentage of people who didn't grow up with a computer is only going to go down, not up. These evolutions I think go in the wrong direction.

webmobdev2• 7 years ago

I don't think users are confused at all by files and folders. But somehow Apples seems to think they are.

Agreed. And am glad that they were forced to reconsider and have introduced a FILES (https://www.imore.com/files-app) App on ios.

eeeeeeeeeeeee• 7 years ago

Killing or obfuscating the URL is really only good for Google. They don’t want people going directly to any website, they want you arriving at it through a Google property so they can pitch ads to you or at least track you through that funnel.

tylerl• 7 years ago

It's dumb that I actually have to say this.... But chrome isn't actually killing URLs or even taking steps toward killing URLs, despite the clickbait story title.

Instead they're taking steps toward better identifying fraud. But nobody would read the story if that's all it said.

marssaxman• 7 years ago

can we just kill Google instead?

dang5• 7 years ago

Please don't post unsubstantive comments here.

turtlecloud2• 7 years ago

I’m sure that’s a common sentiment and wouldnt be too surprised if an incident occurred

keyle• 7 years ago

Validate and confirm that what you're looking for is good, yes.

Obfuscate what you're looking at, no.

taeric• 7 years ago

Hard to call these the first steps. The entire point of the omnibar is to blur search and address.

lvs• 7 years ago

It's it convenient that Chrome's moves against the URL also makes it easier for Google to MITM/proxy the whole world using AMP?

skybrian• 7 years ago

Headline is misleading. This is about Google's research into how users are misled by tricky URL's and what to do about it.

imhelpingu3• 7 years ago

The article is about how Google PR people are now openly advocating for removing the concept of a "URL" from web browsing for security reasons. What are you talking about.

geofft5• 7 years ago

I don't see any PR people mentioned in the article, just engineers.

dang5• 7 years ago

Please don't spoil a perfectly fine comment by putting in a swipe at the end.

https://news.ycombinator.com/newsguidelines.html

imhelpingu3• 7 years ago

"Google Takes Last Steps Towards Killing the Open Web by Making Everyone Register With Centralized Certificate Authorities Just to Run an HTML Server."

I sincerely hope I live to see this quintessentially evil corporation go bankrupt.

maz1b• 7 years ago

There HAVE to be underlying motives at play here. If Google really cared about "dumb users" – I agree phishing and such attacks do pose a threat to the average net surfer, but surely they can use ML to bolster and enhance the warning or safe browsing system that they already use, and use that as an additional plus point or marketing point. To imply that this is being done merely for the sake of the "user" is laughable.

This is simply a red herring to (eventually) guide user interface behavior towards a system or set of systems that moves towards obscure, non-transparent and centralized control.

zestyping2• 7 years ago

If I'm understanding correctly, it sounds like the plan is to use heuristics and machine learning to guess which URLs look "tricky".

I'm highly skeptical of an approach that involves training users to rely on a black-box ML system. That just makes them ever more dependent on technology they can't possibly understand and puts more power in Google's hands. By being the sole arbiter of what is "tricky," Google gets to blacklist the entire Internet.

It would be better to help users understand the URL. I don't mean expecting users to parse the syntax on sight; I mean finding ways to display or represent it so that the important information is easier to see and fraud is easier to spot.

j16sdiz2• 7 years ago

It is worse then a blacklist.

Blacklist is easy to understand, as long as we trust Google (lots of us don't) everything would be fine.

With ML, not even Google have a full picture of what's going on.

kevingadd• 7 years ago

At this point ML to govern things like autoplay or address bar is just whitewashing for biased data. You feed biased training data into an ML algorithm and now it's unbiased! Select your training data set and other parameters such that you get a result you want and you're good to go. The history of machine learning for tech is a history of obvious biases creeping into training data - whether it's a medical algorithm "learning" that background markings are an indicator of disease instead of classifying the tissue it's meant to, or recidivism risk algorithms going off race & gender to the point that they produce actively bad data, or face detection algorithms thinking that asian people are squinting.

I don't even think that youtube necessarily should get an autoplay prompt on first use, but it's pretty convenient that ML-based approaches like this are used instead of much simpler approaches.

Lots of research is going into creating adversarial data given known ML algorithms, as well. If this address bar ML is running on the client (it'd have to, right?) then it's not hard to do a training run against it to come up with custom tailored URLs/sites to get the ML to classify your attack as good.

zestyping2• 7 years ago

Really good point.

ML equals diffusion of responsibility.

aaronmdjones• 7 years ago

Along the lines of your last thought (helping users understand the URI, displaying it in an idiot-proof manner), this wouldn't be at all hard if they simply had 4 separate areas for protocol, hostname if any, domain & public suffix combined, and path. e.g.:

    https://www.example.net/foo.html

becomes:

    [https] [www] [example.net] [foo.html]

Then they can colour the public suffix e.g. black and the rest of it light-grey, much like they do already, BUT it's also clear which box you always need to look at to determine the site's identity.

It could go even further and obscure the contents of the first, second, and fourth boxes, until you mouseover or focus it (but all of the boxes should appear light red in background for http, and light green for EV, even if you can't see the text in them), and the last one should be far from the one before it, to avoid e.g.:

    [https] [www.example.net] [example.org] [foo.html]
    [https] [www] [example.org] [www.example.net/foo.html]

(It would be easy to accidentally think you were somewhere at example.net with both of the above, even though you're really somewhere at example.org)

Clicking on any box (or the regular Ctrl+L) could turn it back into one box (for easy URI copying) and defocusing it will revert it again. Power users could set a knob to simply always display the 1 bar they've been looking at for the last 25+ years.

Maybe there could even be a conditional 5th area for the query parameters (GET variables) which isn't even shown by default (without input area focus), who knows.

    [https] [news] [ycombinator.com] [reply] [id=19032043&goto=item%3Fid%3D19031237%2319032043]

Just my wild 4am ideas... probably lots of things wrong with it I can't imagine right now.

Matheus28• 7 years ago

I'd personally invert the order of the 2nd and 3rd areas. Yes, it'll look ugly, but it's way easier for users to parse for phishing:

https://example.com.phishing.com -> [https] [phishing.com] [example.com] [foo.html]

thecatspaw• 7 years ago

while we're at it we could make the query parameters into a textfield which could expand into a table, for easier editing of values

etxm• 7 years ago

Ditch the protocol and show a lock or not. My parents don’t know what “https” means.

Or ditch the protocol and not render http at all by default.

cryptonector• 7 years ago

My take was that the plan is to come up with a plan. Not the first time I hear of that regarding URIs.

threwawasy1228• 7 years ago

Does this really sound that alien to people? I seem to recall the internet being controlled and blacklisted from a large portion of the population by AOL. Recall when people used to think that AOL keyword search was the entirety of the internet? This doesn't seem that much different from the old AOL tactics in my opinion.

paganel• 7 years ago

Recall when people used to think that AOL keyword search was the entirety of the internet?

I'm not the OP but I personally don't remember any of that because I'm not an American (like a major part of populace on the Internet) and I've never used AOL. And maybe AOL failed in America exactly because it did the things you mention they were doing, i.e. "controlling and blacklisting" a large part of the Internet.

sireat• 7 years ago

Not alien but just a highly undesirable outcome.

In the 90s while mass AOL CD mailings were going out there was fear that "AOLization" of the internet would happen.

The same incentives for AOL curated and walled garden are present today for Google, Facebook etc.

pixl97• 7 years ago

AOL wasnt the internet. It was a private network that eventually allowed you access to the internet as its popularity increased. Once dialup died they made a broadband client.

If Google is trying to make their own private internet on top of the public internet I'm sure a few antitrust regulators will start asking about their hold on search and ad markets.

kkarakk4• 7 years ago

I'm highly skeptical of an approach that involves training users to rely on a black-box ML system.

google did it with youtube, if they do it to chrome i don't know if they can handle the developer frustration that will ensue(i'll put a nice red fullscreen browser incorrect banner on my website if users visit from chrome)

dhimes2• 7 years ago

Agree. And what fun we'll have when Google's ML systems screws up our authentic site's classification. I'm sure they'll jump right up with an apology.

neolefty6• 7 years ago

It's not ML, according to an update to the article at the very end:

Correction January 29, 10:30pm: This story originally stated that TrickURI uses machine learning to parse URL samples and test warnings for suspicious URLs. It has been updated to reflect that the tool instead assess whether software displays URLs accurately and consistently.

throw2016• 7 years ago

This is a classic example of 'manufacturing' a problem so you can 'solve' it in a self serving way.

At some point technical discussions will have to rise above current naivette and various parroted 'laws' and demonstrate understanding of the real world, corporate and human behavior instead of lamenting after the horse has bolted.

wyattpeak• 7 years ago

While I'm no great believer in their particular solution being motivated by pure altruism, it's simply false to suggest that the problem is manufactured.

Telling whether a site is being served by who you think it is is fast becoming a crucial skill, to the point where I explain at least the basics to even the most technically illiterate people I know who use a computer. It's a real problem, in substantial need of a solution.

bad_user2• 7 years ago

Why can’t the solution simply be education?

I don’t buy this learned helplessness. Schools need to evolve with the times.

We teach kids calculus in school, surely we can teach them to read a freakin URL.

PretzelFisch• 7 years ago

"Killing the url" The title is a little clickbait, I guess. Google only discussed displaying a warning when a url looks phishy. Or did I miss the killing/hiding url part?

j16sdiz2• 7 years ago

They have been doing it for awhile. Removing https://, removing the padlock, removing www., Hide the path...

Klathmon• 7 years ago

Https still shows up for me, as does the padlock, www is still showing as well (that change was fairly quickly reverted after the feedback they got).

dbbk2• 7 years ago

Safari was doing it long before Chrome ever did.

everdev• 7 years ago

while URLs may not be going anywhere anytime soon

Nothing in the article talks about killing the URL, just flagging spam URLs like G00GLE.com (with zeros) that might be security risks.

strikelaserclaw• 7 years ago

Jesus Christ, how do they get these titles? do the people posting even read the damn article?

dang5• 7 years ago

Instead of posting an empty rant, which breaks the site guidelines, it would be helpful if you'd suggest an accurate and neutral title, preferably using language from the article itself. Then we can change it and everyone's eyes can stop hurting.

arkades2• 7 years ago

"What we’re really talking about is changing the way site identity is presented," Stark told WIRED. "People should know easily what site they’re on, and they shouldn’t be confused into thinking they’re on another site. It shouldn’t take advanced knowledge of how the internet works to figure that out."
And while URLs may not be going anywhere anytime soon, Stark emphasizes that there is more in the works on how to get users to focus on important parts of URLs and to refine how Chrome presents them.

I read that as "Google is working on decoupling site identity and navigation from URLs."

muthdra2• 7 years ago

Because scammers are exploiting the way we use URLs for the detriment of users. URLs are great as a mnemonic point of entry but you can easily scam someone out of a trusted website into your cloned version of it without them even noticing; it's a very slow and very dumb attack where the shady URL itself is the corrupt man-in-the-middle.

avanderveen• 7 years ago

Changing the UX for URLs in a browser that has overwhelming market share is going to change how people think about and assess the identity of websites they visit.

Over time, it could make other browsers feel less familiar, old fashioned, and maybe even shady for most people.

It may end up improving security for some (we'll see), but it may also improve the security of Chrome's market share (whether that's the motivation behind the move or not).

walterbell• 7 years ago

There is an AMP proposal for certificates to replace DNS for web site identity. In that scenario, Chrome would stop showing URLs and would only show the human-readable identity that signed the page, as validated by a certificate. This would allow signed site pages to be navigated offline or replicated widely or blacklisted.

Demo video & more info: https://news.ycombinator.com/item?id=17923156

Eridrus• 7 years ago

I don't really want to drill into what's happening with AMP, but I am skeptical of attempts to move from domains to some concept of real world entities with signing. We tried that with EV certs, but it turned out pretty easy, albeit expensive, for bad guys to get EV certs.

trumped• 7 years ago

kill AMP first, then talk about that, Google.

wyck• 7 years ago

Google continuing to undermine the founding principles of the web for that sweet sweet ad revenue, a very minor part of the actual web experaince for a dwindling population of ad clickers. Digging a hole straight down sugarcoated with BS and delusion.

Jedi72• 7 years ago

Its all about control. They want to own you.

jpeg_hero2• 7 years ago

lost in the discussion is that major brands spend millions buying their own name back from google.

see an ad on tv and then type in "progressive" into the omnibox and click on the first link (paid ad by Progressive Auto Insurance on its own brand) and google gets $10+

type in "progressive.com" and google gets $0

freedomben3• 7 years ago

A bit conspiratorial and counter to Hanlon's Razor, but an interesting and reasonable theory. But $10 for one click? How do you know that?

turtlecloud2• 7 years ago

The click price is open info.

a quick google search on keyword pricing would send you to keyword planner that will show click price.

If you think it’s fake news just bid on the keyword yourself.

It’s a bit offensive to claim conspiracy when facts don’t align with your understanding of the world.

jpeg_hero2• 7 years ago

https://www.wordstream.com/blog/ws/2011/07/18/most-expensive...

if it's your own brand you get quality score 10, so that cuts the price from the approx $54+ that another bidder would have to pay.

aboutruby• 7 years ago

The only new bit of information I learned from this article is Google's Trickuri project: https://github.com/chromium/trickuri

It contains all sorts of interesting test cases to test how various URIs are displayed in various parts of the UI.

RcouF1uZ4gsC• 7 years ago

Sounds like Google is re-inventing EV Domains. EV Domains attempt to tie a URL to a business securely. Unfortunately, nobody pays attention to EV certificates.

Now we will be getting a proprietary Google replacement of EV Domains.

prepend• 7 years ago

Do you know what is not confusing at all? And is also fraud proof? AOL keywords.

I always wondered who Google would be, but I never guessed AOL.

This is a terrible idea, but I suppose it is easier to organize the worlds information this way.

seanp2k2• 7 years ago

Came here to post this; they're re-inventing AOL keywords. It was bad then and it'll be bad now. Chrome is user-hostile.

dreamcompiler• 7 years ago

Very misleading headline. The article does not say Google wants to kill the URL; it says Google wants to take steps to make sure users can more easily see what domain they're on and make it harder for scammers to spoof legitimate domains.

hoffs3• 7 years ago

It wouldn't be good journalism if the idea of the change wasn't all twisted to some conspiracy theory.

marcus_holmes3• 7 years ago

This is to protect dumb users. Can't we train them instead? I'm getting fed up of everything in my life being dumbed down so that idiots don't hurt themselves with it.

Can we put up a "you must be at least this willing to learn stuff in order to use this internet" sign on the information freeway on-ramps?

armitron• 7 years ago

It's dumb users that provide all the value that turned Google into a behemoth. Pretty powerful feedback loop there. The Internet wasn't ruined in a day but it sure happened quick and superorganism-like parasitic corps like Google are for the most part directly responsible.

If you train dumb users to the point of non-dumbness they will install ublock origin. Train them a bit more, they will install umatrix. Then they won't use Chrome. Or Gmail. Or anything Google.

hoffs3• 7 years ago

Google is a company which provides a product, chrome. It is in their intrest to protect those users in a way that they desire. Why would they leave idiots hurting themselves when they can enhance their product by protecting those idiots, which also improves the satisfaction by the users.

IshKebab• 7 years ago

People aren't dumb just because they aren't experts on URLs.

AsyncAwait3• 7 years ago

No, but they're at last lazily negligent if they spend a significant part of their day online and still haven't learned how URLs work.

marcus_holmes3• 7 years ago

You're creating a false dichotomy.

I am defining "dumb" as "incapable of determining what url they are visiting and therefore vulnerable to scams". That's a looong way from any sane definition of "expert".

tokyodude• 7 years ago

Safari already does this to some extent and as a dev I hate it. I have 2 jsfiddles open in separate windows. The URL area just shows "jsfiddle.net" so there is no way toa see if 2 identical looking fiddles are the same or different nor which was is the fork and which one is the original.

sharkjacobs• 7 years ago

I might be misunderstanding something (not familiar with jsfiddle) but if your problem is that you can't see the full URL you can change that at Preferences>Advanced>Show Full Website Address

saagarjha2• 7 years ago

Not on Mobile Safari :(

Falkon1313• 7 years ago

Sure if you know to look for it you can find that setting and fix it, but how do you know which other settings also default to shady dishonest behavior and can you find all of them to fix? Obscuring the URL to present one thing as being the same as another is definitely a shady malware-style practice. Intentionally deceiving the user should not be the standard default for the default browser of one of the top OSes.

sunseb• 7 years ago

Yeah folks at Google want their search engine to be the entry point for the web - not the url.

We need to find (and promote) alternatives to Google (and Facebook). They are making the world a WORST place.

_pdp_• 7 years ago

The way they killed all their other useful products?

onetimemanytime• 7 years ago

Exactly! No need to remember websites anymore, just go back to google, search again and click on some ads while you're there. Sorry, but I don't trust Google or their self-serving proposals at all.

48309248302• 7 years ago

Showing URLs is essential. Google isn't able to determine what sites are safe. You can test it by signing up for a lot of Google Alerts. I get fed many shady URLs in Google Alerts and have clicked on some of them accidentally because the URLs aren't displayed in the emails anymore. If the URLs had been clearly displayed, I wouldn't have clicked on them.

A tool that warns people when something appears wrong with a URL would be useful, but hiding URLs from users would be a terrible idea. It will create a generation of people who don't even have the capability to visually scan a URL to see if it's safe.

Technology shouldn't be dumbed-down for people so much that many people who are capable of learning how it works will never see enough of the details to become curious. I've even met professional web developers who don't understand URLs well due to the current URL trimming in most browsers.

systematical• 7 years ago

Maybe I missed something, but I didn't see anything about removing address bars or promoting AMP in there... Then again its late here.

kmlx• 7 years ago

for everyone that says or implies that “google is out to get us”:

we have had users that thought the small green https lock next to the url meant a shopping site (the lock resembles a purse). so seeing it meant “safe shopping” by google.

users are much less knowledgable than anyone here can imagine.

z3t4• 7 years ago

Shouln't web certifacates be supposed to solve the identity issue !? It's not the first time Google tries to kill the URL though. The reason why Google want to kill the URL is that they want to replace it with a Google search bar, and that instead of typing in a URL you make a google search. Google pays browsers a lot of money in order to make the url bar work that way.

xg152• 7 years ago

I understand their motivation, but in none of the articles murmuring about them "taking away the URL", I have never so far seen any concrete approach how their replacement could look.

Even if you are willing to sacrifice the "you can write them on a napkin and share them with everyone" feature, it's not clear to me what other identifier would fundamentally solve the identity problem:

Even if you forced every website to get an extended validation certificate from a preselected CA and then based website identity solely on the certificates, what would stop you from registering a misleading company name? (There are precedents for that, btw. Search for "World Conference Center Bonn Scandal" if you want to read some hilarity)

Additionally, as the article mentions itself:

The big challenge is showing people the parts of URLs that are relevant to their security and online decision-making, while somehow filtering out all the extra components that make URLs hard to read.

I feel the approaches we have seen so far rest on the assumption that the top and second level domains of the hostname are the only "important" parts of an URL and the rest can be hidden. I think this assumption is simply false, even for a vast number of non-technical use-cases: Often, "identity" is not just about the organisation behind an URL but also about the content - e.g., you'd like to know which article of a blog a link leads to.

More importantly, many sites are divided into user profiles, where the identity of a user is given by a subdomain or a path segment. Just knowing you're on "https://facebook.com" doesn't tell you whether you're viewing the actual profile you want to view.

Finally, even the "cruft" is sometimes important, if only for knowing it's there. E.g., I frequently remove tracking/referral arguments before sharing a link - both to make the link easier to remember and to disrupt tracking.

Also, unrelated:

The Chrome security team has taken on internet-wide security issues before, developing fixes for them in Chrome and then throwing Google's weight around to motivate everyone to adopt the practice

Is that how we imagined internet governance to work? Didn't we have standards bodies like the W3C or the IETF that were supposed to make decisions on that scale?

majewsky• 7 years ago

Search for "World Conference Center Bonn Scandal" if you want to read some hilarity

FYI: I tried, and the only Google result is this exact HN post.

xg152• 7 years ago

Ah, apologies. I guess my optimism was too great that this made more than local news.

I can't find an english-language article about the story, so here is a german one:

https://m.dw.com/de/der-bauskandal-um-das-world-conference-c...

To summarize the story:

Bonn used to be the capital of West Germany during the Cold War. When that was over, however, Berlin got reassigned as capital and Bonn went back to being a mostly ordinary small town.

They never quite got over the demotion though and the city made numerous attempts at staying internationally relevant. One project was to become a UN base of operations for Germany. Apparently for that, it's a requirement that your build an oversized hotel and conference venue.

The city had trouble finding investors for the project, but eventually a korean company - "SMI Hyundai" stepped forward.

If you want to believe the official records, then apparently due diligence went out the window at the mention of the name "Hyundai". City officials assumed that they were somehow affiliated with the automaker and were quick to trust them with city-backed loans in the millions.

It turned out they were scammers and not even remotely capable of contributing to the project. In the end, the city had damage of several 100 million euros.

The company had never had any relation to the automaker either. It just "happened" to have the term "Hyundai" in its name...

macca321• 7 years ago

Google should never have given pagerank rewards for 'meaningful' URLs, they should have given it for meaningful link descriptions.

URLs should be opaque, then we wouldn't have the mess of people trusting them. Also we would have HATEOAS instead of OpenAPI :D

nakodari• 7 years ago

I am skeptical that they can kill the URL. It's like those smart inbox startups that decided to kill email a few years ago but they ended up shutting down and email has become a stronger and more important tool in communication now. Some things don't need to be replaced or killed. If it works, it works. URL is the foundation of the web and killing it would be more difficult than killing the email. Just my 2 cents.

eleitl• 7 years ago

This is why I stopped using Chrome years ago. My current Firefox is configured to display the protocol along withe the FQDN, without any munging thankyouverymuch.

Google is self-isolating into a walled garden. Good riddance.

degenerate• 7 years ago

All of these "help the dumb Chrome user" additions to Chrome really need a way to be turned off. All the Chrome team needs to do is have a Developer Options section, which they already do in Android, that allows us advanced users to undo all the asinine changes to the browser over the past 2 years:

- OS-style scrollbars were removed [1]

- Backspace no longer goes back [2]

- Can't click on the "Lock" in URL bar to see certificate info anymore

- Tabs were redesigned, and take up more space

- Extensions are no longer a simple list, but are now gigantic unnecessary "cards"

- "Chrome Web Store" link from Extensions section is now hidden underneath hamburger menu

- Half the themes for the old design are literally broken now

Those are the biggest buggers for me, and Google simply throws up the middle finger <^> to advanced users and expects us to understand these changes are better for everyone. NO they are not! Let us turn these "features" off in Developer Options.

[1][2] There are extensions that can re-enable these top two removals. The rest cannot be changed.

t12ya• 7 years ago

Any large software project is taken over by bureaucrats if all basic issues have been solved by the real programmers.

Chrome introduced garbage like rounded corners, now this.

It's the Gervais principle in action.

deanclatworthy• 7 years ago

I don't see the outrage here. Using heuristics to determine the likelihood of a URL being fake, sounds like a good idea as long as it's weighted against false positives.

That said, I've never understood why browsers do not highlight the hostname separately from the path. Many phishing domains are of the form: google.com.auth.something.else.realistic.looking.tk/fake-path-stuff and are so long that the user just sees google.com and moves on. Something as simple as underlining the hostname or making the path a slightly lighter hue would be a huge usability improvement in being able to stop phished hosts.

Leace• 7 years ago

Firefox does highlight registered domain "looking.tk" in white font and the rest of the URL is colored gray ("google.com.auth.something.else.realistic.looking.tk" and path).

Sujan2• 7 years ago

For me it is black for the domain vs. dark grey for the rest (FF65). I actually never noticed this before, nice!

owaty• 7 years ago

I've long been curious how exactly they determine the "registered domain", and your comment made me finally look for the answer. It looks like they use (and semi-manually maintain) a list of "effective TLDs": https://www.publicsuffix.org/

The maintenance process is described here: https://github.com/publicsuffix/list/wiki/Guidelines

the_jeremy• 7 years ago

Chrome does this as well. news.ycombinator.com is in black and the rest of the URL is more grey.

notSupplied• 7 years ago

This isn't sufficient, as it highlights the sub-domain, which is the main trick scammers are using. For exmaple: http://google.com.gmail.inbox.totallynotgoogle.com

rwmj• 7 years ago

A better idea might be to allow EV certificates to contain a large logo which is displayed next to the URL bar, and ensure that only trademarks can be placed by their holders into these certificates.

ccnafr• 7 years ago

The article talks about showing warnings when accessing misstyped URLs, not "killing URLs."

Nothing in the article I've read suggests they're doing anything of the kind. What a bunch of clickbait bs.

If you search this HN comments page, you'll find 3-4 other people claiming the same thing.

This article is an insult to news reporting.

jesseryoung• 7 years ago

Yes, I was very confused by the title as well. The introduction briefly talks about "changing the way site identity is presented" but after that it talks about just flagging suspicious URLs. Nothing in there about actually "killing" them.

ajvs• 7 years ago

Solutions: True Sight browser extension to identify CDNs like AMP[1].

It shows an icon in the address bar to inform you whether the website is in part or wholly being hosted by CDNs (eg Google, Cloudflare, CloudFront, etc).

You can block partial CDNs (eg scripts, images) using NoScript or uMatrix, for full webpage CDNs like AMP you'd have to observe the True Sight warning and navigate away manually at the moment.

For partial CDNs it's also worth noting the Decentraleyes extension, which loads popular resources from it's offline source rather than the CDNs.

[1] https://addons.mozilla.org/en-US/firefox/addon/detect-cloudf...

webmobdev2• 7 years ago

True Sight seems interesting. I am exploring ways to avoid Google Amp completely ...

neolefty6• 7 years ago

That's useful, but it's not what this article is about.

This article is about a tool called "TrickURI" which detects misleading names like "G00gle.com"

t0astbread• 7 years ago

This is a worrying development. It seems like this tool would help endangered users but also penalize legitimate sites/services. Not to mention, this is Google shaping the internet to its needs again.

Also, the title is clickbait so now I feel bad for upvoting.

EamonnMR• 7 years ago

This has been a long time coming. Wacky things like 'https://' awhere never going to fly with the general public. Though tech support for them is going to get a bit harder now.

Causality1• 7 years ago

Frankly I'd rather use a browser that blocked all URLs with non-ASCII characters than one which didn't show the plain URL in the address bar.

pvorb2• 7 years ago

Why not simply show identicons that represent a hash of the domain you're on? https://vorba.ch/2018/url-security-identicons.html

Shorel2• 7 years ago

I don't think simply and identicons belong to the same sentence.

pvorb2• 7 years ago

I just watched the talk "don't say 'simply'" the other day [1]. You're right, "simply" is wrong here.

[1] https://jameshfisher.com/2018/09/13/dont-say-simply-writethe...

juststeve• 7 years ago

So, google would become an authoritative source of all websites if this goal is achieved?

are they proposing that DNS standard is "updated" so that every request at runtime must verify that a website is legit?

cdnsteve• 7 years ago

Firefox and Duckduckgo here we come! Recent Google/Chrome changes have me baffled. It's a great time to switch. Vote with what you use folks.

mancerayder3• 7 years ago

This combo works fine. Also, using DDG as your default search engine gives you more diverse results, because you can also just do g! prior to the search terms to automatically send to search to EvilCorp --- oops, I mean Google --- as needed.

prestonpesek• 7 years ago

This is an attempt to seal off one of the main pathways out of interaction with its monopoly. “This will make you safer” is a common refrain of those who seek to maintain control over everything you do.

neolefty6• 7 years ago

The actual work doesn't seem to be at all — it's about a tool called TrickURI that identifies names that are visually confusing such as "G00gle.com". The headline is clickbaity.

So if I go register a name "neolefty" that nobody has ever heard of, TrickURI isn't going to object unless there's a fantastic service out there already called "ne0lefty". Which sounds legitimate to me. Kind of trademark-law-y, but consensus is how language works.

JohnBooty• 7 years ago

Great example of why we need diverse browser culture, instead of a Chrome monoculture.

When we hand Google a browser monopoly, we hand them de facto authority over everything related to the web.

It will effectively be up to a single for-profit entity with questionable-at-best motives how we see the web in fundamental ways.

That's not to say the work they're doing here is bad. Might be good. And it's a long ways from production. But that's besides the point.

99052882514569• 7 years ago

Exactly. Having recently switched from Chrome to Firefox, I'm puzzled by language such as "Google is thinking about killing the URL". Nope, still featured prominently in my address bar, protocol and all, and Google has zero say about whether it stays that way.

dandare• 7 years ago

Why don't all browsers simply visually emphasize the TLD and second level domain (or third level in a case like example.co.uk) in any given URL?

Yes, sometimes it is not easy to recognize the real address in a scam URL like "dropbox.com.scam.ru" but browsers could make absolutely clear what the TLD and SLD are.

sricks3• 7 years ago

The version of Firefox I'm on right now does. Most of the current URL is a light gray, while the "ycombinator.com" portion is white which gives much more contrast against the dark gray background of the URL bar. (I'm using the dark theme, but I'm pretty sure the normal theme does this, too.)

dangerface• 7 years ago

the complicated part is developing heuristics that correctly flag malicious sites without dinging legitimate ones.

Its not complicated its impossible, google just don't care if they kick other people off their internet.

anuraj• 7 years ago

So by obfuscating data from users - Google is salvaging Internet?

boztek• 7 years ago

Reminds me a bit of the "URL"/transition component of Doug Crockford's post-web secure distributed app delivery idea.

https://youtu.be/O9AwYiwIvXE?t=2400

Shorel2• 7 years ago

My wild guess, based on events this week:

The step zero has been partnering with MS to kill Firefox.

chimen• 7 years ago

You only need a threat to introduce any kind of "safety measures". This is a trend that is done by governments all over the world as an excuse to enter and take, do surveillance and monitor all kinds of activities. It's no surprise that they always put safety in front of measures designed to align with their marketing agenda. The masses will agree unfortunately and blindly subscribe.

I'm still waiting for them to find a "safety-first" reason to ban adblock from the store.

exegete• 7 years ago

The TrickURI tool mentioned in the article: https://github.com/chromium/trickuri

aouk• 7 years ago

since the problem is with "careless" users when it comes to "noticing" or "reading" a URL, which have a position in the screen that I suppose most users know by now, then, I think that the solution should be designed around UI/UX principles, since one of the purposes of UI/UX (correct me if i am wrong) is to let and help the user "read" and "notice" every bit of information using every pixel in the screen.

if the goal is to help the user "notice" and "read" URLs, then why not just (for example):

-use another font for URLs, one which mitigate the similarities between characters

-make the URL bar bigger with a bigger font

-use a small popup (à la Wikipedia) that shows the URL clearly when the user hover it. Actually something happens when you hover a link in some browsers, a lost, grey container with a black font appears in the bottom left of the window, it contains the URL of the link.

but if the goal is to setup "yet another input device" for a database of shady URLs and domain names, well... you will surely need to integrate not only with the UI/UX parts of the browser which have the greatest usage share.

or if the goal is to hide one important part of the mechanics of the web (and make software feels even more magic...) then, don't show the URL at all.

auslander• 7 years ago

I feel the end game is that all websites will be served to you by Google, like an invisible proxy. And you wouldn't be able to see it. Google search already modifies the result links with google ones, to see which result you clicked. AMP plays to that goal too.

footprintcomp• 7 years ago

Wouldn’t displaying the top level domain name in bold or another colour make identification easier, or am I missing something?

lapinot• 7 years ago

Besides the fact that this article is a clickbait, "killing URLs" is a actually something that is happening. I'm surprised nobody put this in relation with the fact that google has a search engine, something much more important to this topic than the fact that it has a web browser. Hiding URLs and making them 2nd class citizen means nothing alone. The reason it is done is to promote an alternative way of accessing/finding things, with the goal of controlling how people move/navigate (since this is directly translatable to ad-money and behavioral data collection). Just think about every single ad-based (eg lock-in based) social network/service/web-app: they want you to navigate through their searchbox and result page, because they want to control what you see and keep you from going away.

So killing URLs isn't much about this particular action from google or about web-browsers, it's actually embodied by the much broader trend towards searchbox-centered ui and "related stuff"-based navigation (instead of an absolute classification system like trees, tag hierarchies etc). Please f*ck off with your search engines and recommendation systems, just give me some tools to build taxonomies so i can organize myself. I know what i want and i know how i want it classified. IT was meant to organize (and process) databases please just stick to that, i want a library not a bookshop.

Google Takes Its First Steps Toward Killing the URL

Related Stories