Category: Google|Aug 24, 2020 | Author: Admin

Google to trial drastically truncated URLs in Chrome in anti-phishing move

Share on

Google will run a trial with Chrome 86, the browser set to release in October, that will hide much of a site's URL as a way to foil phishing attacks.

"We're ... going to experiment with how URLs are shown in the address bar on desktop platforms," Emily Stark, Eric Mill and Shweta Panditrao, all members of Chrome's security team, wrote in an Aug. 12 post to a company blog. "Our goal is to understand -- through real-world usage -- whether showing URLs this way helps users realize they're visiting a malicious website, and protects them from phishing and social engineering attacks."

The test will roll out in Chrome 86 – currently slated to ship Oct. 6 – with participants chosen randomly. Stark, Mill and Panditrao did not specify the number of Chrome users, or even a percentage of the browser's total, who will see the address bar pilot. Enterprise-enrolled devices won't be included in this Chrome 86 experiment, they added.

Rather than display the entire URL in Chrome's address bar, the trial will instead condense it to what Google called the "registrable domain," which it explained means (the "most significant" part of the domain name). If the full URL for, say, a Computerworld article is https://www.computerworld.com/article/3571442/microsoft-sets-new-support-deadlines-for-ie11-and-edge.html, then the registrable domain would be computerworld.com.

Showing only the domain, the three Google engineers argued, might make it easier for users – those who look at the address bar, anyway (not everyone does) – to ensure they were at the right place, not at a malicious site they'd been tricked into visiting. "There are myriad ways that attackers can manipulate URLs to confuse users about a website's identity," Stark, Mill and Panditrao said. "(That) leads to rampant phishing, social engineering and scams."

(The trio cited a 2020 research paper – "Measuring Identity Confusion with Uniform Resource Locators" – to make their case. Of the nine who wrote the paper, two were from Google; the remaining were from the University of Illinois at Urbana-Champaign.)

To view the complete URL, the user simply moves the pointer atop the address bar and let it hover for a moment. At that time, Chrome reconstitutes the URL to its full form. Another way: Chrome will sport a new item in the right-click menu – "Always show full URLs" – that will set the address bar to show the whole URL for all sites.

Although Chrome 86 won't be available in the final ready-for-release form – Google calls that Stable – for months, users can put the test to, well, the test now. Using either the Canary or Dev builds (now at Chrome 86), users can enter chrome://flags in the address bar, then set these two items to Enabled and relaunch the browser:

#omnibox-ui-reveal-steady-state-url-path-query-and-ref-on-hover
#omnibox-ui-sometimes-elide-to-registrable-domain

(In Computerworld's test, the macOS version of Chrome 86 Dev did not display the "Always show full URLs" item in the right-click menu.)

This won't be the first time that Google has monkeyed with the way the URL appears in Chrome's address bar. Two years ago, for instance, Google dropped the www and m prefixes, but after pushback, reversed course on the former.

Sponsored Ads:

Comments:


Apple sidles into sideloading in the EU

Category: Apple|Apr 21, 2024 | Author: Admin

Report: Microsoft-OpenAI ownership might get conditional OK from EU regulators

Category: IT|Apr 20, 2024 | Author: Admin

Giant change at Google could change everything

Category: Google|Apr 19, 2024 | Author: Admin

Now Windows will be bothered about this too

Category: Microsoft|Apr 18, 2024 | Author: Admin

Test the new AI trick with Logitech

Category: IT|Apr 17, 2024 | Author: Admin

The US Government Has a Microsoft Problem

Category: Microsoft|Apr 16, 2024 | Author: Admin

Now comes the commercial

Category: Microsoft|Apr 15, 2024 | Author: Admin

Linux Foundation is leading fight against fauxpen source

Category: IT|Apr 14, 2024 | Author: Admin

3000 news articles!!! Happy reading!

Category: General|Apr 13, 2024 | Author: Admin

Google shuts down new product

Category: IT|Apr 12, 2024 | Author: Admin

YouTube CEO warns OpenAI that training models on its videos is against the rules

Category: IT|Apr 11, 2024 | Author: Admin

Google unveils Arm-based data center processor, new AI chip

Category: Google|Apr 10, 2024 | Author: Admin

Microsoft to invest $2.9 bln to expand AI, cloud infra in Japan

Category: Microsoft|Apr 9, 2024 | Author: Admin

Nintendo shuts off online access for 3DS and Wii U today

Category: IT|Apr 8, 2024 | Author: Admin

Musk challenges Brazil's order to block certain X accounts

Category: IT|Apr 7, 2024 | Author: Admin
more