4 ms·

What about the URL bar? For average non techie users, the URL bar isn't particularly helpful. They use page content. And AMP pages do show the original page do

What about the URL bar? For average non techie users, the URL bar isn't particularly helpful. They use page content. And AMP pages do show the original page domain name.

ilikehurdles 6y ago
The URL bar is helpful to fighting phishing attacks. It's one of the things everyone at my company, including the non-technical people, is askedt to check before entering information. Also techie and non-techie people have been using the same browsers for how many decades now? Aren't the majority of people in many countries on the internet? It seems like the average non-techie users succeeded in figuring things out so far.
- delouvois 6y ago
  URL are "not particularly helpful for non-techie users" ? How did you even end up here is beyond me.
  - pbhjpbhj 6y ago
    Presumably you know that non-technical users, IME, use Google instead of the URL bar. And, if Bing is the default search engine they search Google first, then enter the website name in Google, then click on the first result (without checking the URL). This is the primary way I've seen "non tech" users navigate to a website. Some will use the address bar, but they're in the minority. No matter how much I berate my family they still all do this, so I'm no longer surprised to see it when visiting a client (though I don't do web design/training since last year).
- u801e 6y ago
  > The URL bar is helpful to fighting phishing attacks It would have been nice if client side TLS certificates were more popular. Then your browser could warn you that you're not using your client cert when connecting to a certain website and not allow you to complete the connection. That would be a better solution as opposed to relying on users to manually check the URL.
  - arbitrage 6y ago
    while we're wishing for things that just won't ever happen, can I have a pony?
  - ralph84 6y ago
    How does a client-side cert help with authenticating the server? Why wouldn’t a phishing site also ask for the client-side cert if the real site does?
    - u801e 6y ago
      ~~It wouldn't work because the phishing site would lack the private key needed to validate your client-side certificate and the TLS connection would not be established. This is assuming that the legitimate website itself signed your certificate signing request (CSR) to create the client-side certificate.~~ Edit: What I posted above is not correct. What I should have said was that the server would validate the client certificate by checking a certificate authority (either managed by the server itself or a 3rd party).
      - Arnavion 6y ago
        >It wouldn't work because the phishing site would lack the private key needed to validate your client-side certificate and the TLS connection would not be established. That is not how TLS works. A server can trust a client based on the certificate the client presents. A client can't distrust a server based on the certificate the client presents. "The phishing site would lack the private key needed to validate your client-side certificate" is nonsense. Neither the real site nor the phishing site have the private key used to generate the CSR; only the client that sent the CSR has that, and validating a cert does not involve the private key in any way. If you're thinking of a new protocol where the server itself generates an arbitrary asymmetric keypair and shares it with the client, then a) that's not TLS, b) that could just as well be done with a symmetric key (since this is just pre-shared key auth) where the server presents a nonce to the client to sign and verifies the client signed it, and c) a fake server can just not do that.

What about the URL bar? For average non techie users, the URL bar isn't particularly helpful. They use page content. And AMP pages do show the original page domain name.

ilikehurdles 6y ago

The URL bar is helpful to fighting phishing attacks. It's one of the things everyone at my company, including the non-technical people, is askedt to check before entering information. Also techie and non-techie people have been using the same browsers for how many decades now? Aren't the majority of people in many countries on the internet? It seems like the average non-techie users succeeded in figuring things out so far.

delouvois 6y ago
URL are "not particularly helpful for non-techie users" ? How did you even end up here is beyond me.
- pbhjpbhj 6y ago
  Presumably you know that non-technical users, IME, use Google instead of the URL bar. And, if Bing is the default search engine they search Google first, then enter the website name in Google, then click on the first result (without checking the URL). This is the primary way I've seen "non tech" users navigate to a website. Some will use the address bar, but they're in the minority. No matter how much I berate my family they still all do this, so I'm no longer surprised to see it when visiting a client (though I don't do web design/training since last year).
u801e 6y ago
> The URL bar is helpful to fighting phishing attacks It would have been nice if client side TLS certificates were more popular. Then your browser could warn you that you're not using your client cert when connecting to a certain website and not allow you to complete the connection. That would be a better solution as opposed to relying on users to manually check the URL.
- arbitrage 6y ago
  while we're wishing for things that just won't ever happen, can I have a pony?
- ralph84 6y ago
  How does a client-side cert help with authenticating the server? Why wouldn’t a phishing site also ask for the client-side cert if the real site does?
  - u801e 6y ago
    ~~It wouldn't work because the phishing site would lack the private key needed to validate your client-side certificate and the TLS connection would not be established. This is assuming that the legitimate website itself signed your certificate signing request (CSR) to create the client-side certificate.~~ Edit: What I posted above is not correct. What I should have said was that the server would validate the client certificate by checking a certificate authority (either managed by the server itself or a 3rd party).
    - Arnavion 6y ago
      >It wouldn't work because the phishing site would lack the private key needed to validate your client-side certificate and the TLS connection would not be established. That is not how TLS works. A server can trust a client based on the certificate the client presents. A client can't distrust a server based on the certificate the client presents. "The phishing site would lack the private key needed to validate your client-side certificate" is nonsense. Neither the real site nor the phishing site have the private key used to generate the CSR; only the client that sent the CSR has that, and validating a cert does not involve the private key in any way. If you're thinking of a new protocol where the server itself generates an arbitrary asymmetric keypair and shares it with the client, then a) that's not TLS, b) that could just as well be done with a symmetric key (since this is just pre-shared key auth) where the server presents a nonce to the client to sign and verifies the client signed it, and c) a fake server can just not do that.