Google Chrome 76 hiding information - Page 1
Forum section: electronics / general

author: MrMobodies
author_rank: Super Contributor
timestamp: August 11, 2019, 06:26:02 am
content: I was out visiting someone who was complaining about some broken feature in Chrome where it started showing search history in the address bar and I was surprised to find something. It doesn't do it on mine as I prevent it from updating automatically and I found this article about it.https://www.bleepingcomputer.com/news/google/google-chrome-hides-www-and-https-in-the-address-bar-again/QuoteI guess when they worked with other browser representatives to set these so called standards to obscure information to the user that the user may want to see it may no longer becomes a choice on their platforms.I don't want the information of the URL's reduced and messed with because someone thinks it will be easier for me.Firefox did this some years ago and where was a parameter I use to set to disable the URL trimming so it is nothing new.browser.urlbar.trimURLs;falsehttps://support.mozilla.org/en-US/questions/949113QuoteI was showing them Pale Moon to try and they liked it.There is that "suspicious site reporter" extension which unhides it and the flags but how long will they be in there for before they remove them in the future?What to do you think?

author: ataradov
author_rank: Super Contributor
timestamp: August 11, 2019, 06:39:25 am
content: Hopefully some scammers find a way to exploit this and goolge will reverse this BS decision. Or at least make a setting for people that want to see this information.

author: ataradov
author_rank: Super Contributor
timestamp: August 11, 2019, 06:43:24 am
content: Although I just got a Chromium update "Version 76.0.3809.87 (Official Build) Built on Ubuntu , running on Ubuntu 16.04 (64-bit)" and I see full URLs. Not sure what is going on. May be Chromium is more sane, in which case this may be a workaround.

author: 2N3055
author_rank: Super Contributor
timestamp: August 11, 2019, 07:37:35 am
content: Go to chrome://flags and search for:---------------------------------------------------------------Omnibox UI Hide Steady-State URL SchemeIn the omnibox, hide the scheme from steady state displayed URLs. It is restored during editing. – Mac, Windows, Linux, Chrome OS, Android#omnibox-ui-hide-steady-state-url-scheme........................................................................................Omnibox UI Hide Steady-State URL Trivial SubdomainsIn the omnibox, hide trivial subdomains from steady state displayed URLs. Hidden portions are restored during editing. – Mac, Windows, Linux, Chrome OS, Android#omnibox-ui-hide-steady-state-url-trivial-subdomains.......................................................................................Omnibox UI Hide Steady-State URL Path, Query, and RefIn the omnibox, hide the path, query and ref from steady state displayed URLs. Hidden portions are restored during editing. – Mac, Windows, Linux, Chrome OS, Android#omnibox-ui-hide-steady-state-url-path-query-and-ref---------------------------------------------------------------and change them from default to disabled...

author: The Soulman
author_rank: Super Contributor
timestamp: August 11, 2019, 08:26:37 am
content: Thanks, but now the full url disappears after a second and shortens to the main adres.i.e.:https://www.eevblog.com/forum/chat/google-chrome-hiding-information/?action=post;last_msg=2607759tohttps://www.eevblog.com

author: rdl
author_rank: Super Contributor
timestamp: August 11, 2019, 08:37:57 am
content: Why people use Google software of any kind is something I'll never understand.

author: magic
author_rank: Super Contributor
timestamp: August 11, 2019, 08:39:13 am
content: Quote from: ataradov on August 11, 2019, 06:39:25 amThis is America, take matters in your hands if you care

author: 2N3055
author_rank: Super Contributor
timestamp: August 11, 2019, 08:56:48 am
content: Quote from: The Soulman on August 11, 2019, 08:26:37 amSorry to hear that but it doesn't to me...What it does now is it doesn't show http:// for non https pages.. For everything else it shows full URL. Tested on 2 separate PC's.

author: golden_labels
author_rank: Super Contributor
timestamp: August 11, 2019, 09:20:41 am
content: Hiding the scheme in its textual form makes sense. You may not like it, because your brain is accustomed to seeing it, and brains do not like changes and react to them with irritation. But it’s not like it has drawbacks other than that. Not only the information is not lost — there is a corresponding icon — but nowadays HTTPS becomes ubiquitous. I expect that soon you will be able to blindly assume that the URL uses the https scheme, and if it isn’t… you will be presented with a full-window warning about that.If that would be a piece of software in which you routinely use URLs other than using the http/https scheme, I would agree that it is awkward. But no, a web browser is used nearly exclusively with http and https, with only extreme minority of users seeing other schemes like ftp in their address bar.As for hiding well known subdomains, this sucks indeed. But I do not see how it could be exploited against website/user security. If the attacker can control DNS records, your security in that regard is already compromised(1)— it doesn’t really matter if you can see the www/m subdomain. And it matters even less for an average Joe, who don’t even know what they’re looking at.____(1)Unless HSTS preload is used, the attacker has no access to your PEMs and the browser supports HSTS preload.

author: The Soulman
author_rank: Super Contributor
timestamp: August 11, 2019, 09:46:23 am
content: Quote from: 2N3055 on August 11, 2019, 08:56:48 amWhooops, operator error.I've missed: Omnibox UI Hide Steady-State URL Path, Query, and RefThanks again

author: ataradov
author_rank: Super Contributor
timestamp: August 11, 2019, 04:55:26 pm
content: Quote from: rdl on August 11, 2019, 08:37:57 amBecause firefox copies their behavior in the next release anyway. I used FF as long as I could, but then they broke all the good extensions, and became virtually indistinguishable from chrome.

author: rdl
author_rank: Super Contributor
timestamp: August 11, 2019, 05:06:09 pm
content: Yeah, I dropped Firefox years ago, when they decided they knew better than I did how my browser should look. I don't think it'll ever happen, but if I was ever forced to choose between Google and Firefox, I'd probably pay the fee and switch to Apple.

author: Rick Law
author_rank: Super Contributor
timestamp: August 11, 2019, 05:32:35 pm
content: I believe it is along the path google wants to take "the web"...First, they make the address bar the same as the search input field,then they start hiding the "ubiquitous", (http:xxxx may not be the same site as https:xxxx)then they start hiding more, and more...until you have no way of knowing where you truly are (site-wise) and no way of getting to where you truly want.Right now, your visibility is controlled by their search engine. Once users accepts all that hiding, your very existence on the web is controlled by Google.When you got used to typing "Electronic Forum" in the "URL+Search" field and select from the result list to get here, you have no idea whether you got to EEVBLOG, or where ever theystaysay you should go. So, someone can spend eons and tons of money developing an identity on the web, but your brand (address) is under their control. If they so choose to highlight someone else (say an advertiser or someone more inline with Google's world-view), 99% of the Andriod phone (and Chome) population won't be able to get to you. The only visitor you can expect are those those who would explicitly type in your full "http:.....". In time, they can even get rid of accepting direct URL input.In my view, supporting Google = supporting evil. The direction we are going is NOT good.Edit: typo correction "stay you should go" corrected to "say you should go"

author: The Soulman
author_rank: Super Contributor
timestamp: August 11, 2019, 05:51:48 pm
content: But seriously, people should be given the ability to use a "fair" search engine.

author: Richard Crowley
author_rank: Super Contributor
timestamp: August 11, 2019, 06:00:19 pm
content: It has been doing that for months (years?) Doesn't seem like any big deal to me because you can click on the address box (as if you were going to Ctl-C copy the URL) and it displays the full URL.I had to switch to Chrome back when IE was king of the pile because IE stopped displaying actual error messages and obscured everything to generic "Error 500". Making it useless for development and debugging.

author: amyk
author_rank: Super Contributor
timestamp: August 11, 2019, 06:40:59 pm
content: Keep the sheeple uninformed, complacent, and easily persuaded, that's their way to extract more money from them. Remember, they have even fought against the use of adblocking or content-modifying software.Given that she has basically let her email become public, let's hope she gets a LOT of angry emails from users...

author: SiliconWizard
author_rank: Super Contributor
timestamp: August 11, 2019, 06:57:01 pm
content: Quote from: rdl on August 11, 2019, 05:06:09 pmWell. I still use Firefox even with the increasingly annoying stuff. I still trust it infinitely more than any Google product, at least privacy-wise.Haven't tested Chromium in ages. It's the open source version of Chrome right? I suspect the official Chrome may contain additional "features" not present in Chromium. Am I right?

author: golden_labels
author_rank: Super Contributor
timestamp: August 12, 2019, 12:58:45 am
content: Quote from: rdl on August 11, 2019, 08:37:57 amMore or less for the very same reason they use Firefox or IE: because they do not have to immedietly pay with money for using it and because it works for nearly whole population of this planet. Also because Chrome is shipped with 3 out of 4 smartphones, so they do not make any choice in the first place.Quote from: ataradov on August 11, 2019, 04:55:26 pmThat statement, given the tone of the discussion and the context, sounds as if is is an accusation towards Mozilla. An unjustified one. While the transition could’ve been done better — with that I agree and I was pissed off myself — it’s not as simple as “they broke stuff”.First of all, the code had to be redesigned: the old, XUL-based ecosystem was total mess on multiple levels. The new API hasn’t copied Chrome: it is a standardized API shared across browsers to make life of add-on developers easier. The change has been announced long before Mozilla finally removed the support for XUL-based extensions. Add-on authors had more than enough time to port their software. Many of them hasn’t and the reason for that brings us to yet another point. Majority of Firefox add-ons were not maintained anymore. Software, especially programs having any contact with outside world, are not things you can write once and forget about them for years — they need constant care. I was using a lot of extensions myself and slowly, through the years, I had to remove them one after one as they were stopping working. In a few years most of what you had would not be useful anyway — with or without Mozilla’s help.Then, finally, there are those few extensions that indeed fell victims to the change: they were maintained, but there was literally no way to port them (Classic Theme Restorer as an example). But those were a minority. While I hate losing some of them, I am far from thinking about that change in terms of Mozilla breaking anything either intentionally or from negligence.Quote from: rdl on August 11, 2019, 05:06:09 pmDo you think they care more about your opinion?Quote from: Rick Law on August 11, 2019, 05:32:35 pmWhich is… what kind of a problem? Searching for URLs requires additional quotation marks; but other this rare situation: what else is wrong with that solution?Quote from: Rick Law on August 11, 2019, 05:32:35 pmYes, the HTTP one is the one you shouldn’t be using.In any case: the information is still displayed (just not as the scheme in the URL).Quote from: Rick Law on August 11, 2019, 05:32:35 pmAm I missing something (I do not regularly use Chrome)? Since when you can’t type a URL into the address bar and aren’t taken there? Are they also hiding resource name now?Quote from: Rick Law on August 11, 2019, 05:32:35 pmAs it is, if you use Google directly. But the last time I was checking that, one could’ve set any search engine. Their help documents tell this is still true.Quote from: SiliconWizard on August 11, 2019, 06:57:01 pmChrome is rebranded Chromium (that, not the other way around) with proprietary video decoders added. Chrome also has some changes to configuration: you may install add-ons only from their store and telemetry is enabled. As for privacy: you’re asking about the largest spyware producer in world’s history. While Chrome is more likely to have various tracking enabled (and you may not opt-out from it), I’ve already seen reports from friends, who have seen Chromium calling home during build preparation stage. There is no way you could trust it in that matter.

author: Rick Law
author_rank: Super Contributor
timestamp: August 12, 2019, 04:23:05 am
content: Quote from: golden_labels on August 12, 2019, 12:58:45 amThe problem is the conflatingan instruction from the userwitha request from the userso as (in my opinion) for Google to achieve a very selfish goal.You (the browser) are interpreting my instruction "to go to a specific place" not as an order to follow, but as a "request for suggestion" for where you (the browser) think I should go.(I am watching the movie "A few good men", so I will borrow a few good words from it to help me express myself here...)When I give an order(entered URL address), I expect it to be followed- there is no choice in the matter for the browser, I expect it to say "Aye Sir" and go where I order it to go - it has no choice, the URL is exact. When I want advice (do a search), then I will ask. I expect it to say "Yes Sir" and then give me a list with entriesit chooses.That is one of the reasons why I rejected Chrome - it thinks it is superior and it knows better where I should go. No thank you! I know where I want to go and the last thing I need is a suggestion from Google.In myopinion, the whole pointGoogle conflates the twois todiminish the important of a domain name (URL/brand name). You go everywhere by searching, you tell them what you seek and they tell you where they think you should go for whatever you are seeking. When every one conflates searches of text meaning with domain name matching, than domain name means nothing. You (the domain owner) are just the provider of a few pages in the world of Google.Your domain name (URL/Brand) which you might have spend huge $ and resource to build is meaningless and useless - you are just what their search engine say you are.Quote from: golden_labels on August 12, 2019, 12:58:45 amWe have a major disconnect here. Yeah, you are missing something...What you missed is in my reply that you quoted from, but not in the part you quoted. It was the first sentence of that reply.That reply started with the line: I believe it is along the pathgoogle wants to take"the web"... (Bold added)I did not write "google took", and not "google has taken". I wrote "google wants to take"... Thus, I was expecting the reader to infer thatI am predicting/guessing future Google/Chrome behavior: First they do this, then they do that, then they do those...

author: MrMobodies
author_rank: Super Contributor
timestamp: August 12, 2019, 06:49:18 pm
content: https://www.cnet.com/news/google-chrome-team-tries-to-fix-url-problems-better-web-addresses/QuoteNot broken in the first place.QuoteEveryone? Followed by that outcry in late 2018? that they had to back track.QuoteChanging it would be difficult so they just want to hide the information to the user as a standard.QuoteAssumptions made about the user. What about them. Did they have the same assumptions placed on them as a user.QuoteTrying to make it easier by restricting/hiding information. Rubbish... I have seen the fake Godaddy login Portal months ago. No warnings about that. I reported the ones I have found which seems to be on sites hosted by Godaddy I remember on frescoprints.com.QuoteOf course it may look gobbledygook for those who haven't seen it before.Nothing new about the presence of long url's.QuoteBecause it's long it MUST be confusing... bullshitI was "new" like everyone else at one time and I didn't have a problem with that it helped me. A newbie may never know and as they deem it is so trivial for them. What about the people making this policy was it ever trivial for them as users and in their line of work like thatAdrienne Porter, Parisa Tabriz and Emily Schechter?I want "better"detailed information like before no less. That is what helps me understand and protect myself over the years. I wouldn't trust a browser alone to show me a magical symbol not when it can be compromised. A bit like what happened with a customer's Chromebook where the Chrome browser got altered and taken over/altered from dodgy extensions that reinstall on their own and a bank's website domain wouldn't load past a point but no warning about that until I reinstalled it. The bank put hold on the online account and the asked them to change the password.Not all URL's are long and they making it out be so difficult to even understand it that you shouldn't see it to be able to relate it.On this forum: Protocol: "httpS://" Sub/Domain: "www.eevblog.com" path/anchor: "forum/chat/google-chrome-hiding-information/" parameter: "?action=post;msg=2611242"I am getting less satisfied with browsers that are going to be set interfere by these so called "academics" and in this case with the viewing of the address/location bar and tell me BUGGER ALL that I have click a couple of times or install extensions to see it and flags that may not worl or be taken away. In England in the past they can spoof numbers so you don't get to see the real number which undermines my confidence in that system.Edit:Looking at their Linkedin profiles:QuoteHelping? More like restricting.QuoteDespite the outry and they state about the "personalty of the user".Research-driven from academics?QuoteThey all seem to work in California and do the similar things at Google such as autofill, two of them malware detection and security."Security in the user not seeing the full URL.How would they manage if someone above them came along and decided the things they see were trivial and insisted that they shouldn't see it as it will be harder and difficult for them to understand.Isn't it called arrogance?

author: MrMobodies
author_rank: Super Contributor
timestamp: August 12, 2019, 09:09:21 pm
content: Sorry for length of the other post and double post but look what I found:https://www.peerlyst.com/posts/meet-the-awesome-department-of-chromeland-security-team-of-4-girl-hackers-securing-our-internet-newswatcherQuoteThey all work together and another one: Emily StarkLinkedin:QuoteThat explains why they do similar things.

author: golden_labels
author_rank: Super Contributor
timestamp: August 12, 2019, 10:50:19 pm
content: What some people write here made me question my memory, so I have even installed Chromium to see if anything has changed since the last week, when I last seen Chrome. Nope, my memory is right. Nothing has changed. Are you using nightly/snapshot version or something?Quote from: Rick Law on August 12, 2019, 04:23:05 amExcept that it is not conflating anything. You do not need to have separate input boxes to state your intent. If you type an URL or something address-looking, it will be treated as one. Exactly as it would be if you would type it in the address box. Otherwise it would be an error. If you type something else, it will be a search term — almost exactly as with the search box.(1)You are describing a problem, that doesn’t exist. It may be against your habits, but that doesn’t make it wrong. E.g. I myself have 5 different functions combined in a single input fieldin Firefox(address bar, standard search box, keyword-trggered search engines, bookmarks search and — since my default search engine is DDG — all the bangs). A lot of space saved.I do not know what do you mean by “selfish goal”. Especially since Google wasn’t even among browser vendors when this feature has been first developed and deployed. What doesn’t it even have to do with that company?Quote from: Rick Law on August 12, 2019, 04:23:05 amExploring motivation of someone else isn’t an easy activity, because there are high chances we’re just reflecting our own expectations and fears in such theories and not basing it on all available observations. Do you realize, that what you are describing is not happening? If you enter a URL into the address/search box, you are being taken directly and exactly to where you requested the browser to be taken to. I have just double checked that a moment ago. I have even tried a domain alone. Perhaps I do not see something; perhaps there is some URL that is not treated like one — all it takes to convince me is provide that URL.However, what you have described is in part true. Not in Google trying to make world look like that, but in reality already being that — independent of Google actions. Most users do searches instead of entering addresses. Even more, typically they just enter the first portion of the name, because they do not know the FQDN. This is why for important websites users are encouraged to use bookmarks. Otherwise they are likely to either enter a wrong address, or use a search engine and face a phishing attack through results manipulation or ads. We, the people who actually understand URLs and remember proper addresses, are a minority. An exception.Quote from: Rick Law on August 12, 2019, 04:23:05 amNo, that part I have intentionally ignored, as I wanted to discuss facts. I assumed that the rest of the statement is about actual actions and not what they could potentially do.Quote from: MrMobodies on August 12, 2019, 06:49:18 pmUnfortunately: broken. Do not assume that just because FOR US those are understandable and WE can remember them, URLs are natural and useful for majority. No, they aren’t and users generally fail miserably in using them. See my anwer to Rick Law above — the fragment after the second quotation — for details.Quote from: MrMobodies on August 12, 2019, 06:49:18 pmBut the information is still visible, just in a more readable form. (except for the “common subdomains” issue, which I have already mentioned earlier)Quote from: MrMobodies on August 12, 2019, 06:49:18 pmPerhaps you are making assumptions about majority, based on your minoritian view of the situation? Look around you, see how people actually use web. If you do not believe your own eyes or somehow have contact only with the minority, just see where money go. Surprise, surprise… scammers use search ads, similar domain names and typosquatting and they are successfull, because people do not really do what you believe they do. You want ignore scammers, because they may be just taking opportunistic chances? So, umm… you see, Google has that as an ipmortant part of their business model. But possibly you are right and Google is bankrupting. Same goes for other search engines.Quote from: MrMobodies on August 12, 2019, 06:49:18 pmThe hidden information would not affect that case in any way. So what’s the point?Quote from: MrMobodies on August 12, 2019, 06:49:18 pmAgain, you represent minoritian view of a technical person, who has taken effort in understanding how things work. For a typical person comprehension ends around the first dot in the domain name (unless it is the ‘www” prefix: then the second dot). With web being more and more used on smartphones, the actual visibility of the URL ends not much later.Quote from: MrMobodies on August 12, 2019, 06:49:18 pmIf that symbol can be compromised, what is displayed in the address bar can also be changed. However, the padlock symbol is not providing you with any information (neither is presence of “s” in the scheme). For that you need to verify certificate, by checking if you’re using the right domain… which is exactly what browser vendors are trying to make easy. Perhaps in the end we’ll finally have only CN displayed, instead of useless(2)for most people URL.Quote from: MrMobodies on August 12, 2019, 06:49:18 pmExcept that article doesn’t speak about people of academia. They are only petitioned to search for better solutions.Quote from: MrMobodies on August 12, 2019, 06:49:18 pmI have no slightest idea what’s the point of that, so I am simply ignoring it.____(1)With the exception of the aforementioned using an address a search keyword, but for that you just need to just quote it… which nearly surely you want to do nonetheless to limit fuzzy matching.(2)It is useful for debugging, but that’s all. And for that purpose it may be displayed upon request.

author: MrMobodies
author_rank: Super Contributor
timestamp: August 13, 2019, 12:27:36 am
content: Quote from: golden_labels on August 12, 2019, 10:50:19 pmAs a user that is how I relate things which I'd find difficult myself if they were hidden like that and discover it later.I don't often understand things that well when what they deem as "mumbo jumbo" is hidden for the purposes of making it easier but as you say I'm a minority.QuoteI don't mind it secure/insecure and able to check on the side but I don't want it "simplified" for for when I copy and paste url's.QuoteWell over the years I have had lots of customers come to my house for that sort of thing, I spent all night removing malware manually and I try to educate them so they don't fall for it that easily again. I don't try to make it easier by REDUCING/RESTRICTING information. I set it all up so they can see what they are doing and most of they come back for other things. On Windows they hide extensions for known file types by default and no one can tell that easy when a malware program is made to look like a word document. Better for the customer to learn and tell the difference and start learning.One issue I came across is, they search for "print drivers" for a printer and they accidentally click on an advert ontop of the page, on Google or Bing that looks like a search result and leads them to some "driver update/manager package" and other things start installing. I don't see that happening as often now.QuoteI meant about no warning about the site certificates (in the fake login portal) and I wonder why they were targeting sites hosted on Godaddy.QuoteYes I suppose I am small part in a minority. In that case with smart phones and tablets (with touch input) might not always be easy to get about the url.QuoteI have noticed and that is handy alongside it where I can check those things.QuoteThey seem to be behind the change and they know each other despite all the backlash.The other things like the viewing of certificate stuff near the url is a positive but I don't my view of the URL messed with in terms of "simplifying it" and not without an option to leave it alone.

author: The Soulman
author_rank: Super Contributor
timestamp: January 05, 2020, 11:10:30 pm
content: It happened again!I guess it is no longer in experimental stage as it no longer can be disabled as in the instructions below.Giving up on computers altogether soon.Quote from: 2N3055 on August 11, 2019, 07:37:35 am

author: ataradov
author_rank: Super Contributor
timestamp: January 05, 2020, 11:15:17 pm
content: You can now install google's Suspicious Site Reporter extension and it will bring back https.But yeah, firefox is looking more and more attractive with chrome's stupidity.

author: Mr. Scram
author_rank: Super Contributor
timestamp: January 05, 2020, 11:27:09 pm
content: Just don't use Chrome. Why would you willingly use a browser specifically designed to map and log your online behaviour?Quotehttps://protonmail.com/blog/best-browser-for-privacy/It gets even worse. Google catches and logs your username and password every time you sign into a website. On any site, not just Google's. They do claim to irreversibly hash this, but at this point you lose control entirely. They also log the websites you visit to catch malicious sites. Nowhere is mentioned they won't use this data elsewhere.Quotehttps://security.googleblog.com/2019/12/better-password-protections-in-chrome.html

author: NiHaoMike
author_rank: Super Contributor
timestamp: January 05, 2020, 11:44:31 pm
content: There's Chromium, Chrome without the Google stuff.https://chromium.woolyss.com/

author: ataradov
author_rank: Super Contributor
timestamp: January 06, 2020, 12:00:50 am
content: Chromium only removes tracking, but not the stupid "design" changes, like hiding https from the URLs.

author: magic
author_rank: Super Contributor
timestamp: January 06, 2020, 06:20:31 pm
content: QuoteThere is no such thing as a secret key known only to a piece of freeware deployed in billion copies worldwideI presume they just hash it and "encrypted" it the way some PR drone described it because nobody knows what's hashing. Or maybe not? Of course tinfoil hatters will interpret it their own way and Google will cry about being falsely accusedClearly the times of Google employing brain tasers in job interviews have passed long ago

author: amyk
author_rank: Super Contributor
timestamp: January 07, 2020, 03:35:32 am
content: The "security" argument is such bullshit. Yet the sheeple swallow it without thinking..."Let us do everything and take over your life for you. You don't want to hurt yourself, right?"I've never used Chrome and never will, but Google's search results are also screwing around with the URLs they display now, fortunately I have a filtering proxy rule to rewrite them back to how they're supposed to be (it's still not perfect but I haven't had the time to fix it fully... hopefully I will before they decide to make it even worse!)

author: golden_labels
author_rank: Super Contributor
timestamp: January 07, 2020, 11:58:56 pm
content: Quote from: magic on January 06, 2020, 06:20:31 pmI am far from being amicable towards Goofle, but this is technically incorrect. Yes, there is such a thing: if the key is generated by each instance of the said software separately. Which is the case here — the algorithm generates a key each time it is invoked.

author: magic
author_rank: Super Contributor
timestamp: January 08, 2020, 08:53:05 am
content: So how is the Mothership supposed to know what hash you are asking for if it's encrypted with your throwaway key?OK, I clicked the link again and scrolled all the way down. Seems you are right, though I still don't get all of it.At any rate, they send just enough unencrypted identifying information to be able to narrow your username down to 1/16777216 of all usernames, which they say is about 250. And they send you a list of all those 250 hashes but everything is encrypted back and forth with multiple keys so that presumably you are somehow prevented from using this service to scrap all hashes from Google's database unless you already know each exact hash you want to query.At any rate, you send anunencrypted3 byte hash to Google. And that's good enough to narrow you down to about only 250 usernames known to them.And they still could have said "a unique one-time key generated by Chrome" instead of "known only to Chrome". Notice that I wasn't even rating about the (in)security of this scheme but about the PR disaster that this description is.And since that 3-byte hash algorithm has to be public, I wonder what would happen if we triggered bucket collisions by creating specially crafted account names somewhere and leaking the passwords to the internetIt seems that while there are 16777216 buckets, at the very least you should be able to severely load a particular chosen one if you desire it for whatever ends.

author: tom66
author_rank: Super Contributor
timestamp: January 08, 2020, 09:07:42 am
content: I am amazed at the number of conspiracy theorists on an engineering forum -- you would expect people on here to be a bit more rational.The point of removing http:// and www. from the URL is to make the design cleaner and it easier to see what the domain is, because in the *vast majority* of cases those components are unnecessary detritus. There's no grand conspiracy here... but, you can always use another web browsing product, if you truly are worried about Google being evil (I have little doubt they are, but for other reasons). Or I'm sure someone will develop a plug in that restores this data if you need it.

author: magic
author_rank: Super Contributor
timestamp: January 08, 2020, 09:15:19 am
content: Who said anything about any grand conspiracy?All complaints I have seen is that Chrome is becoming a browser for idiots who don't even know it's possible to browse the Web without Google's services (and it is becoming like that) and of course Google isn't shooting their foot by nudging those idiots to stop being such idiots (and they indeed are not)

author: SeanB
author_rank: Super Contributor
timestamp: January 08, 2020, 09:33:31 am
content: Still, better than Edge or IE, I use it as work as the default browser, but at home I am using Firefox, just a LTS version that tends to have a lot of the cruft stripped out. That and adblock, ghostery and noscript with ublock as well, strange how many sites are not cluttered with all the ads, plugins and such turned off.

author: golden_labels
author_rank: Super Contributor
timestamp: January 08, 2020, 02:44:12 pm
content: Quote from: magic on January 08, 2020, 08:53:05 amEarly in the morning a group of a few tired officers will deprive you of your electronics for a long time, and you will be informed about Art. 269a KK.Quote from: magic on January 08, 2020, 09:15:19 amI find it pretty amusing to see such extreme opinions about others coming from the mouth (or fingers?) of a person, who themself misunderstands the concepts they’re criticizing. Don’t you think it would be wiser to first understand what k-anonymity is, that Google is not the one who invented, proven it (it was Sweeney, the director of the Harvard’s data privacy lab), or even promoted (it was Troy Hunt), what are the factors at play and even such basics as knowing that encryption key being known to everyone doesn’t imply possibility of decrypting data?

author: GlennSprigg
author_rank: Super Contributor
timestamp: January 08, 2020, 03:03:41 pm
content: Unfortunately, almost all Browser 'variations' these days, even the one's I like, all seem tobe 'Chromium' based. However, some have GREAT/DIVERSE options to intervene with settings!

author: magic
author_rank: Super Contributor
timestamp: January 08, 2020, 06:12:22 pm
content: Quote from: golden_labels on January 08, 2020, 02:44:12 pmHow naive. Even assuming I have never heard about Tor, what if I work for Russian/Chinese intelligence?They better have something stronger to protect their Internet infrastructure than laws.Quote from: golden_labels on January 08, 2020, 02:44:12 pmWhat's an extreme opinion about others?That idiots exist? Dunno, maybe it's extreme, maybe it's not. Look at the Internet for inspiration if you seek the answer to that.That Google (and other vendors) make software for the lowest common denominator of humanity at the cost of breaking usability for advanced users? This doesn't seem extreme, I think it simply is a fact.Quote from: golden_labels on January 08, 2020, 02:44:12 pmNo, because I don't care about this feature and have no plans of using it. And I'm not even a Web developer either so I don't have to listen about it at work.As far as I can see, somebody came up with a way of querying a hashset without the ability to scrap the full set and without disclosing the full key but 24 bits to the service provider. Good for them. And that's all I said (except for the initial SNAFU where I indeed didn't read the full article). Am I wrong?And you see, this attitude is exactly the reason why everybody hates those damn nerds from Google et al. They (you?) just think the world owes them to understand everything and care whether they are right or wrong. We don't, we don't.Myself, I just don't wan their crap "innovations" thrown at me without even asking for it. Rest assured I barely use their services anymore and I used to be a fanboy.Quote from: golden_labels on January 08, 2020, 02:44:12 pmOh yes, Mr Smartypants. Now you tell me how the PR blurb I quoted could conceivably be interpreted as involving asymmetric crypto and how that scheme could possibly work?

author: Mr. Scram
author_rank: Super Contributor
timestamp: January 09, 2020, 07:30:29 am
content: Quote from: Richard Crowley on August 11, 2019, 06:00:19 pmWhy hide relevant information displayed in a spot reserved for it pretty much from the start? It feels like hiding the fuel level of a car behind a hatch. You won't need to look at it every minute but there are reasons to keep an eye on it.

author: golden_labels
author_rank: Super Contributor
timestamp: January 10, 2020, 04:47:50 am
content: Quote from: magic on January 08, 2020, 06:12:22 pmIf you would never hear about it, you wouldn’t be able to pull off the whole scheme, because no one would believe you if you would start selling poisonous datasets on eBay. However, how naïve to think that Tor can protect against detection with serially committed crimes. I believe you misunderstand what Tor protects as much as you misunderstood what Google does.Quote from: magic on January 08, 2020, 06:12:22 pmThen I would say they have greatly lowered their standards.Quote from: magic on January 08, 2020, 06:12:22 pmLaws are an important element of defence in depth, and in this case they may even provide the basis of the protection. I believe you miss the amount of illegal work you would have to do to poison that hashtable. Creating tens of millions of fake but unsuspicious accounts, attacking a dozen of high-profile companies, accepting payment for the “stolen” data and then acting as if you were actually spending it (and I remind you most cryptocurrencies are more traceable than wire transfers). Good luck if you are not in fact an APT. All this to make Google… introduce a 5 minute fix: adding a configurable salt.Quote from: magic on January 08, 2020, 06:12:22 pmYou haven’t said “idiots exists”, which would be a purely statistical statement. You pointed to very specific people. Even worse, the tone of that statement suggests that you feel superior compared to them.Quote from: magic on January 08, 2020, 06:12:22 pmAs it happens, “the lowest common denominator”, your Untermensch, are the ones who are providing nearly all of the income to Google and therefore are the ones for which the company will care most in the situation when they have to choose how to allocate money. No one is preventing you and other “advanced users” from forming your own company that will cater to the needs of “advanced users” — usingyourmoney. You may just be surprised when you learn that your “advanced users” are merely people, who simply refuse to adapt and it has nothing to do with actual usability, and you are ending up with software that can satisfy none of them.Don’t get me wrong: I dislike many changes too. I am unhappy with many changes that in fact saved little resources. But the reaction I see here is way too exaggerated and many claims are plain wrong.Quote from: magic on January 08, 2020, 06:12:22 pmAnd that is the problem. There is a difference between opposing change that harms you, and not being able to accept change at all. Perhaps you should start caring about what’s right or wrong for you? If you use a password manager and long pseudorandom passphrases, which indeed makes the feature unimportant and you may stay with notifications about leaks for the given domain, then fine. But otherwise not using password checks like this is hurting your security much more than even revealing your whole password set to HIBP or Google in plaintext.(1)You are not exceptional, you are not magically protected from threats everyone else is vulnerable to.Quote from: magic on January 08, 2020, 06:12:22 pmUnless you are a very rare breed of user that runs with 3rd party servers blocked and JavaScript disabled, you are unlikely to not use their services, or not being observed by them. In particular in Poland, where half of your email correspondents are in the Gmail domain or their mail is forwarded to their Gmail accounts. That includes revealing your passwords to Google.Quote from: magic on January 08, 2020, 06:12:22 pmIt could be interpreted as anything. Neither interpretation is more likely than the other.Quote from: Mr. Scram on January 09, 2020, 07:30:29 amBecause, unlike fuel level, it is not relevant at all during normal use. Whether it is HTTP or HTTPS is not providing you with much useful information while simply browsing.____(1)Except for intranet passwords: in their case there are some arguments to weight. But this is unlikely to be what concerns most people commenting on this subject.

author: Mr. Scram
author_rank: Super Contributor
timestamp: January 10, 2020, 06:09:28 am
content: Except that the full address can be useful and not just because of SSL. There's no reason to hide it while there are reasons to view it.

author: golden_labels
author_rank: Super Contributor
timestamp: January 10, 2020, 07:28:07 am
content: And what are the reasons to see the scheme name other than debugging broken servers? Though even that can be done by simply realizing that non-TLS connections will not have a certificate.

author: ataradov
author_rank: Super Contributor
timestamp: January 10, 2020, 07:31:26 am
content: For me the reason is that I absolutely hate when thing jump around. And that's exactly what happens when you click on the address bar to select and copy the URL. And now I have to make more mouse movements to get back to the point of the text I wanted to select.Plus there is absolutely no need for this. The address bar is long and saving 5 characters is not that significant.

author: rdl
author_rank: Super Contributor
timestamp: January 10, 2020, 11:03:36 am
content: Reminds me somewhat of those idiot web pages where the last bit of a section of text fades away and you have to click "More..." to see the rest of it. What do those fools think they are saving? Certainly not paper. It can annoy the user and cause them a bit more work though. It's almost funny how often "more" turns out to be less than another full line.Quote from: ataradov on January 10, 2020, 07:31:26 am

author: golden_labels
author_rank: Super Contributor
timestamp: January 11, 2020, 01:13:40 am
content: Quote from: ataradov on January 10, 2020, 07:31:26 amThe first comment in this Goofle-bashing thread that actually raises some real issue. Yes, that makes sense. But, still, you can disable the feature.Quote from: ataradov on January 10, 2020, 07:31:26 amIt is not only about the length. That’s also about radability. For people less familiar with technology the full URL is just: “gIbB:/ErI/Sh.important.part/gib/ber/ish?and=more&meaningless=giberish&with=hofok9n1f5a1cf1ckztxjg2xceqfn8na9rhprgy0coczbv3g2rxzx9qd”. Trimming reduces that to: “important.part/gib/ber/ish?and=more&meaningless=giberish&with=hofok9n1f5a1cf1ckztxjg2xceqfn8na9rhprgy0coczbv3g2rxzx9qd”. Yes, perhaps it would be great to live in a world in which each and every person understand what the “gibberish” part is. But this is not happening and there is no reason to think it will happen. Sometimes reality sucks, happens.For many people, who think they understand URLs, and most people to whom I talked and who believed they have a practical use for the full veresion in everyday browsing, it was even something else: “misinterpreted://important.part/gib/ber/ish?and=more&meaningless=giberish&with=hofok9n1f5a1cf1ckztxjg2xceqfn8na9rhprgy0coczbv3g2rxzx9qd”.

author: amyk
author_rank: Super Contributor
timestamp: January 11, 2020, 03:30:08 am
content: Quote from: golden_labels on January 11, 2020, 01:13:40 amI imagine many centuries ago, people thought there was no reason to be literate.Of course, the difference between then and now is that now we have big companies who don't want people to know too much, so they can keep them ignorant and under control...

author: 2N3055
author_rank: Super Contributor
timestamp: January 11, 2020, 09:44:37 am
content: Quote from: golden_labels on January 11, 2020, 01:13:40 amExcept you can't.Quote from: golden_labels on January 11, 2020, 01:13:40 amURL is full address. Nobody wants to understand it. So they took complete full address (that is not human readable sometimes) and changed it to "and here is some computer shit" label.So, because I don't know how to read and pronounce japanese, instead of me verbatim copying address (without understanding that translated it means "Maple leaf streat") of my Japanese friend in Tokyo, I will simply address my letter to : Matsuo Mori, some japanese shit 13, Tokyo.. See, that's better, much easier.Rewriting is,also, basically, address spoofing. Which I have no paranoia that Google will steal my life, but opens a wormhole that if someone really spoofs address, nobody will notice, because you will have no clue how it is supposed to look anyway. And also, if I want to open that same address in some other browser that is not Google based, will I be able to.. You would be surprised how many non tech people are not using copy-paste. They open second window and start typing address as they are see it..It also poses a legal problem: what site did I went too, really? No problem judge, I have a screenshot here.. ups...Address rewriting is a solution to problem that doesn't exist, except in the heads of graphic designers and marketing dept. That think it makes browser look techy and complicated. They like clean look so much that, if you ask them, there would be only on-off button on browser, and no other stuff to "confuse" user. "..You don't really need to USE it, do you... Because, look a it, it's so pretty this way, no need to clutter it with that functional shit......"As somebody said once: "If you make a program that any idiot can use, only idiots will want to use it..."We are getting there fast...

author: magic
author_rank: Super Contributor
timestamp: January 11, 2020, 10:31:30 am
content: Quote from: golden_labels on January 10, 2020, 04:47:50 amIf it's only passwords of accounts which had in fact been hacked then fine, that would be hard to pull off. If it contains also things like username/password lists which have been seen on some shady marketplaces or even pastebin, that could be easier. Bonus if you mix it with legitimate data. Don't tell me you have never hacked your way into a database of 100% reliable PII of thousands of peopleAnd it would probably only take on the order of 100k accounts to make your Chrome downloads megabytes of junk every time you type "golden_label" into a login box here.I take the point that they might be resalting the database every 24h or whatever, which would make the attack quite infeasible.Quote from: golden_labels on January 10, 2020, 04:47:50 amPerhaps you should stop caring about what's right or wrong for me.I don't use a password managerI don't send every domain I visit to Skynet for approval, that's what Chrome users doI don't need Skynet to tell me about breaches at all. The few actually important services that I use over the Internet are important enough that I expect them to lock the account immediately and notify me about breaches. The rest I could live with losing.You know the old joke:noob's password: suzy, because nobody on the 'net knows his girlfriend's namelamer's password: 5uz131337666, because nobody could possibly guess that <-- you are on this stagehacker's password: suzy, because anyone who wants will hack it anywayQuote from: golden_labels on January 10, 2020, 04:47:50 am"Anything" is not an example, Mr Relativist.You cry that I implied you might be an idiot because you appear to use a browser made for idiots but you yourself have no problem babbling that I don't understand the basics of the field I'm talking about without giving proof

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: January 11, 2020, 11:17:39 am
content: I was bitten by this in september: "No, it wasn’t a virus;it was Chrome that stopped Macs from booting"https://arstechnica.com/information-technology/2019/09/no-it-wasnt-a-virus-it-was-chrome-that-stopped-macs-from-booting/Needless to say, no more Chrome for me. GRRR. Never again.Check out Brave guys. Really. It's from the guy that invented javascript, and co-founder of Mozilla. He knows a thing or two about the web...https://brave.com/AND PRESS CMD-L TO SEE THE PROTOCOL IN THE ADDRESS BAR

author: magic
author_rank: Super Contributor
timestamp: January 11, 2020, 12:38:52 pm
content: QuoteQuote from: GeorgeOfTheJungle on January 11, 2020, 11:17:39 amNot sure what to think about itI hope he regrets it at least a little

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: January 11, 2020, 02:05:17 pm
content: Quote from: magic on January 11, 2020, 12:38:52 pmIt's writable because the google updater runs with setuid privileges.$ ls -la /varlrwxr-xr-x@ 1 root wheel 11 Aug 1 2015 /var -> private/varQuote from: magic on January 11, 2020, 12:38:52 pmMeh, Larry Wall and Rasmus Lerdorf ought to apologize first...Would you have preferred VB scripts?

author: magic
author_rank: Super Contributor
timestamp: January 11, 2020, 03:25:48 pm
content: Quote from: GeorgeOfTheJungle on January 11, 2020, 02:05:17 pmGlad that you ask, there actually was a time when young me would have answered yesI totally sucked at English at the time and it took me several painful months to learn even the basics (no pun intended) of JavaScript.I think Perl would be better. Higher barrier to entry, less code created (good thing IMO), more prestige and job security for those actually able to do something useful with it. No minifiers, no obfuscators, life would be happier for developers in so many ways

author: golden_labels
author_rank: Super Contributor
timestamp: January 13, 2020, 02:50:15 am
content: Quote from: amyk on January 11, 2020, 03:30:08 amPlease read carefully. I have written “there is no reasonto thinkit will happen”, not “there is no reason [to make] it happen”.Quote from: amyk on January 11, 2020, 03:30:08 amOh, conspiracy theories again on the rise! Lizard people are upon us!Quote from: 2N3055 on January 11, 2020, 09:44:37 amSo all the sources claiming it can be disabled under “chrome://flags/#omnibox-ui-hide-steady-state-url-scheme-and-subdomains” are lying?Quote from: 2N3055 on January 11, 2020, 09:44:37 amYes, if one makes a-priori an assumption that the address bar should display URLs, then indeed the discussion is over before it is even started. By this logic I could argue that a link to the forum from the main EEVblog page is wrong, because EEVblog needs no forum. You would argue that there is a fault in my logic, because the premise was never stated or proven — and you would be right. In the same way you make an assumption that this field should show an URL.Quote from: 2N3055 on January 11, 2020, 09:44:37 amThat means the attacker would be able to spoof the second-level domain too, so why even bother going for the lower ones and, what the hell, use different name if they can spoof the original one? Assuming someone would do that for whatever reason, how does e.g. “www.yourbank.example” look more suspicious than “m.yourbank.example”?Quote from: 2N3055 on January 11, 2020, 09:44:37 amThat may be a valid point, but it is a minor issue to solve, not a feature blocker. Nowadays those prefixes are seldom used to distinguish servers. If present they are usually used for determining the website type to use: mobile or not. And in particular the “www” and second-level-domain-only addresses are aliases to each other used for backward compatibility. Doing otherwise becomes a pointless practice, considering that now you must have the second-level domain point to something to get HSTS preload. So the problem is not huge and existing trends make it smaller with time.An argument similar to yours can be made for the opposite claim: people are also moving addresses from mobile devices to PCs and vice versa. Explicitly requesting the mobile-version address on a PC or the other way around is also a problem to the user. Have you considered that?Quote from: 2N3055 on January 11, 2020, 09:44:37 am“Look, judge, I have this screenshot here… just please ignore the possibility that I have just edited the URL and you can’t even detect the edit.” If a judge allows screenshots as proofs that one has visited a given URL, there is a problem orders of magnitude larger that how browsers work.Even without editing anything a URL is useless by itself. The displayed URL can differ from the actual URL for ages and in JavaScript-heavy pages it is typical that what you see on the screen is not even addressable.Quote from: 2N3055 on January 11, 2020, 09:44:37 amPerhaps you should start taking other people’s views into account? Your perspective is not the only one and it alone is not the best one.Quote from: magic on January 11, 2020, 10:31:30 amExcept that you have never calledmean idiot. So far.Quote from: magic on January 11, 2020, 10:31:30 amSo if Firefox is made for idiots, which one is not?Quote from: magic on January 11, 2020, 10:31:30 amIn such cases the proof is very simple. It consists of two parts. First: you see a person who is consistenly misunderstanding the subject of the talk and misinterprets issues under discussion. Second: the person repeatedly invokes misconceptions which are unexpected to be used by a person knowing the subject.I assume there is no point in responding to the rest of the message, as you seem to be mainly concerned about defending yourself against having to explore other perspectives. Indeed, it is easier to explain world in terms of “others are idiots” — it requires no thinking whatsoever.

author: 2N3055
author_rank: Super Contributor
timestamp: January 13, 2020, 07:48:22 am
content: Quote from: golden_labels on January 13, 2020, 02:50:15 amNo they are not lying. It used to be possible. Chrome 79.0.3945.117 on PC has that option removed. So it is not possible anymore. And also, that option should be put in GUI advanced options for simple user configurability, not in flags... Check your facts before fighting people...See:https://community.brave.com/t/display-full-url/89775https://support.google.com/chrome/thread/23036602?hl=enQuote from: golden_labels on January 13, 2020, 02:50:15 amWhat else a text box, that used to have title URL written next to it in older browsers, should show?Quote from: golden_labels on January 13, 2020, 02:50:15 amI agree with that. Well said. That is EXACTLY what seems to be that people in this thread are trying to explain to YOU...So we can agree to disagree..Look, I don't mind if they make some things that are controversial. Beauty of software, is that all that is needed is a stupid check box somewhere in Settings, that says "Simple/Expert mode" or something like that. So you and I can both use it any way we want. But they are not "simplifying" anything, just making it crippled.

author: magic
author_rank: Super Contributor
timestamp: January 13, 2020, 09:37:11 am
content: Quote from: golden_labels on January 13, 2020, 02:50:15 amWhat other perspective? That I could be making easy money by creating increasingly complex byzantine shit that people could frankly live without and becoming a SPOF for billions of idiots who trust me with their data?In case it still hasn't dawned on youI am from the software industry and I know it inside out and I know all the "perspectives" and "their-stories" and "narratives" of Silicon Valley and their copycats worldwide.You are not here to change the world and many people are perfectly satisfied with it as it is, without your "progress" and "innovation". Better get used to it.

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: January 13, 2020, 10:30:03 am
content: Quote from: magic on January 11, 2020, 03:25:48 pmMost people who think they hate JS what they hate is the DOM (and rightly so!) but they don't know it because they can't distinguish one thing from the other. JavaScript deserves a bigHave you tried out Brave already?

author: magic
author_rank: Super Contributor
timestamp: January 13, 2020, 10:59:12 am
content: Is Vladimir Putin paying you for promoting it?I still use FF. Too much vendor lockin with all the extensions.As for JS, well, there are people who hate it as a language too. There are some questionable design choices like "undeclared variables become globals", "numbers are floating point" or the bizarro comparisons. I'm sure you have seen the WAT talk tooAlso, it's not just the technology but the effects it has. These days you often need to download megabytes of JS libraries just to see some stupid static textIt really should have been Perl, COBOL, Intercal or something else that would make people think twice before using it at all.Back on topic, the whole "confusing URL" controversy is a complete nothingburger. Here, how FF solved it many years ago and I had an extension which did the same long before 2010. The extension even separately colored the ? and all the request parameters. How awesome is that?

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: January 13, 2020, 12:23:54 pm
content: Quote from: magic on January 13, 2020, 10:59:12 amI don't get it... What do you mean?Quote from: magic on January 13, 2020, 10:59:12 amThat's been fixed a long time ago:"use strict";(function () { b=5 })(); => Uncaught ReferenceError: b is not definedQuoteThat's anot a.QuoteJust don't use == but ===. Yes, some objects still have the wrong typeofs, but that's only a trap for noobs. And to be fair, every language comes with its own footguns. JS unlike other languages can't remove the bad parts because it would break the web => you have to learn not to use them.Quote from: magic on January 13, 2020, 10:59:12 am99% of the web is written by throwing libraries on top of libraries/library plugins to do what in many cases could have been done with direct calls to the DOM in 10 lines of JS, yes.*** Use Brave. Check it out. Now!***

author: magic
author_rank: Super Contributor
timestamp: January 13, 2020, 02:33:48 pm
content: Browser extensions. Those things that add syntax highlighting to the Google Content Identification Bar™ (formerly known as URL bar) and much more. Use them. Your first one is free.

author: Mr. Scram
author_rank: Super Contributor
timestamp: January 13, 2020, 06:02:54 pm
content: Quote from: golden_labels on January 10, 2020, 07:28:07 amJust look at the additional information in the address of this forum page for an example of extra information. I can see the page should be SSL secured, I can see the page is PHP and the query I can see the original title which can change along the way in some threads and I can see page size. That's just one example. Why obscure it when the bar is there already? I could tape up the temperature gauges of my car but I'm not going to do that either.

author: golden_labels
author_rank: Super Contributor
timestamp: January 14, 2020, 02:02:13 am
content: Quote from: 2N3055 on January 13, 2020, 07:48:22 amTIL presenting a different opinion is “fighting”. I don’t know why some people feel so threaten by that, but it’s probably not really important. As for the facts, see what version has spawned that discussion.Quote from: 2N3055 on January 13, 2020, 07:48:22 amWhat else mains sockets, that used to have unearthed 110V in older apartments, should offer in 2020? Hey, who said it must be as it was in old browsers? Why do you assume that 1990s UI is the best ever invented?But IMO? The domain for which the certificate is issued, followed by website-supplied location information. The first part is delivering the actual information about the server’s identity — unlike the URL bar, which just tells you where you intended to go, not where you actually are. The second part is offering the navigation options, instead of just displaying some characters that are both meaningless and useless to most users, and also a constant source of authentication token leaks. For fallback on unauthenticated servers: the FQDN (w/o the common target-device/alias hostnames) or an IP address. For servers that do not offer location information: the resource name w/o the query and fragment. Of course that doesn’t prevent either reading, copying or entering raw URL for anyone who does want that.Before you start opposing that idea: the second part, the location information, is already reality. You are over 10 years too late to protest. The only difference I propose is offering the user a semantic and useful view of that information.If you have missed the change, it’s likely because only a small group of extremists, like myself, made any fuss about it. And the arguments raised back then are no longer valid, since the important vulnerabilities were fixed. I guess that if Chrome would not hide the scheme along with the hostname, most people would miss that change too.I do not know how the certificate view looks in Chrome nowadays, but if it does as it was in the past, it should also be removed. Mozilla is already working on that, eliminating the ridiculous 4-click process of getting the contents of the certificate. If you want to try it yourself, see the Certainly Something extension on which the actual implementation is going to be based. The other things I disliked are already removed: special indicators for the EV certs and green bars/padlocks/whatever for TLS connections.Quote from: 2N3055 on January 13, 2020, 07:48:22 amSo people made the thread to make me see views different than theirs, despite they didn’t know my views before I joined? I miss a head-scrathing emoticon right now.A quick recap. A rant was started about the change, with arguments indicating a very specific, narrow view from tech-focused people. I have joined, showing a different perspective on the same issue. Not even my own ideas on how it should look like. I also poked some people to make them stop for a moment and see that they’re not the only humans on Earth and they’re not even a representative sample of the species, and to make them realize that some they seem to be overestimating importance of the change to their own real use of some feature. I have offered my own view in this very post you’re reading right now. So… who was showing me what, and how?Oh, and of course I couldn’t resist ridiculing a few people who believe in conspiracy theories or consider themselves superior to the general population despite they themself repeatedly show lack of understanding of the subject. Yeah, forgive me — but I guess this isn’t what you were referring to.We’re talking about what I did 5 months ago, so if I missed something, correct me.Quote from: Mr. Scram on January 13, 2020, 06:02:54 pmPlease, do not askmeto look at it, becauseIam not a good representative of the general population. And don’t tell me whatyousee: for exactly the same reason. Ask what an average user can see and of what value is it to them.However, going step by step over your points just to explore the subject… I can’t see what you have described, as I see that right now:What does it tellme?It tells me that the initial request to the server was made through HTTPS. It tells me nothing about the rest of the communication. Using the car analogy: the car is displaying how much fuel you got when you started the engine.But asume for a moment everything goes through HTTPS. Do I care? Nope — I care about being warned if I connect through unsecured connection, not when something that should be the default happens. Using the car analogy: I want my car to show me a warning light if I travel with open doors, not to light it when I have the doors closed.It tells me that the server accepts TLS connections. Is it important? No. Anyone, including any attacker, can have HTTPS. If you go to any phishing website, guess what you will see: a perfectly valid secure connection. What is important is that the certificate is issued for the server to which I am willing to talk to. Can we see that in the URL bar? No.It tells me I have requested my browser to connect the server which I believe is Dave’s website. Did I connected to it? I can’t tell, because the URL bar is only displaying the request. If a DNS record is spoofed, and this is a trivial task for anyone administrating the network the victim is using at the moment, the URL bar will still be telling me I am at eevblog. Of course if the connection is authenticated and I check the certificate that is not possible, but that is not being displayed. Using the car analogy: you have enabled your rear lights and you see indication that they are turned on, but in reality the car is only telling you if you have flipped the switch.It tells me I amreadinga resource named “/forum/chat/”. I am a smart guy, so I recognize that patter immediately! It means I am reading something on a forum, perhaps in a chat! Wait… what chat? And why I feel like I am writing, not reading?It tells me that the browser (because, obviously, not me) have asked for the resource to be supplied with two parameters: action=post2 and start=0. So… what does that exactly mean? Reading the second post? Having a form to send two posts at the same time? Is there post1 or post3? And why am I starting at 0? 0 of what? And what about billions of those less fortunate folks who have no idea about the URL format and what parameters are in programming?Now… let’s come back to the URL you have probably seen. What was the value of the information you have received?Page should be SSL secured? Only the initial request was. In fact a non-secured connection has been made to a third party server, because this forum allows users embedding resources andGeorgeOfTheJunglehas an avatar that uses plain old HTTP.The page is PHP. If I would be pedantic, I would argue that you only see that the server claims it is PHP, or even that the link points to something that looks like a PHP script. But let’s assume the more probable case, that it is in fact a PHP script. Why would you care about that as a user of the forum? Does it make any difference to you if the software, which is only running on the server, is written in PHP, Java, Python or Lisp? And how many people in your family can explain what PHP is? Will someone avoid ASP scripts in fear of being bitten?The URL displays title. In fact it does. So does your browser elsewhere (for most people: the title bar). And it does it better, because it shows the whole title, while URL is a SEO effort that removes some words, truncates the title and adds dashes.The page size. Only if you divide that by the page number, which you must look up at the top or the bottom of the thread.… and let me come back to that SSL security. “Secure” is an tricky adjective, because it’s a scale, not a binary value. So what kind of security are you expecting? Only content from Dave, except text? No, users may post images and other files. No other parties being informed about your activities on the EEVblog forum? Just that form wants to connect to 4 other services, two of which are specifically collecting data about users. And it becomes worse in various image-rich threads. That all links leading from the forum will be secure? No — they may be plain HTTP, or get redirected from HTTPS to HTTP without you having any chance to intervene. Thanks to link rot some of them will also lead to malicious websites. That your credentials will be sent securely? No — the form may be sent through insecure channel and you will see that only after they are sent. That no one has access to the credentials before you even send them? Again, bad news: just this page is trying to run software from 3 different suppliers. Good that at least all of them go through authenticated channel!I like the idea of readable URLs. But usually they are not. With CDNs becoming more and more popular meaningless URLs become even more popular. SEO makes them seem readable… until you realize that very often this is just a bunch of keywords mixed with an identifier and a couple of other numbers.

author: magic
author_rank: Super Contributor
timestamp: January 14, 2020, 08:29:08 am
content: Quote from: golden_labels on January 14, 2020, 02:02:13 amNotwithstanding occasional issues with overzealous RCDs, we don't complain because by some miracle the electric power industry is much better at backwards compatibility than Google could ever dream of.We are talking about the URL bar. Uniform Resource Locator they call it. It doesn't tell you whether all your data are encrypted. It doesn't tell you whether the browser has verified the peer's identity. It doesn't tell you that your CAs have been compromised by your employer or government for HTTPS proxying. It isn't supposed to warn you about pedophiles.It is a unique identifier of whatever thing you are viewing. Some services make efforts to make it human readable, others less so. Sometimes it will show the same thing when you reload, sometimes it won't. At any rate, you can try copy it, you can bookmark it, you can post it on a forum, you can punch it in and press ENTER. That's the whole purpose this thing had ever had.Imagine that there actually exist other, dedicated UI elements for information about TLS status, certificates, unencrypted content and bullshit like that. If people still fall for phishing or MITM in 2020, it's not because they have seen HTTPS rather than HTTP on their location bar, it's because they failed to read what the green bar next to it says or ignored a big exclamation mark or clicked through a warning telling them exactly what is about to happen.Breaking the URL bar is not going to provide the user with more information. And there is absolutely no excuse for going as far as even removing the option to restore normal operation.Quote from: golden_labels on January 14, 2020, 02:02:13 amOh really?Because it looks like a dozen people are hammering a point at you and it's you who just keep coming up with mental gymnastics to justify Google at all cost.

author: MrMobodies
author_rank: Super Contributor
timestamp: January 16, 2020, 08:30:24 am
content: Just noticed the url is at the top of the title and it looks a little like they shortened some of them in their so called breadcrumbs but not all of them.See attached picture.What I do, I search with DuckDuckGo and then with Google search as they seem to display different results sometimes.

author: amyk
author_rank: Super Contributor
timestamp: January 17, 2020, 02:20:22 am
content: I noticed that too, and adjusted my filter to put it back to what it should be.

author: MrMobodies
author_rank: Super Contributor
timestamp: January 17, 2020, 03:12:59 pm
content: I am finding the text a bit big that I had zoom out.Your screenshot looks really nice.Don't suppose you can share your filter/method?