Google resumes its attack on the URL bar, hides full addresses on Chrome 86 | Hacker News Reader

Google resumes its attack on the URL bar, hides full addresses on Chrome 86

androidpolice.com

827 pointsatriix475 comments

Something I haven't seen anyone here bring up yet: many URLs are meaningless to humans past the domain. For an example, look at the top of this page. The only semantic meaning in the URL for this post is `news.ycombinator.com`. The rest, `item?id=24156986`, is meaningless to a human. (But, of course, meaningful to HN's backend.) A lot of (most?) of the URLs on the web are not semantic. They're naked application look-ups. I claim that for this current page, there's no meaningful loss of information by just showing the domain.

But some URLs are semantic. I think losing those would lose useful information for human readers. If we could perfectly know which URLs have useful semantic information for users and which don't, and then only present those with full semantic meaning, I wouldn't mind much.

Main point: I see people saying things like "these designers think people are too stupid to understand URLS." But that ignores that some URLs are not actually meaningful to anyone.

Anticipated responses:

1. You are losing information by taking off the "application lookup" part: the information that an application lookup was made. Fair enough. But I claim it's a small loss.

2. We can never perfectly separate out the URLs with useful semantic information. Which, also probably true. But I think we can do a decent job, and as long as the full URL is present when I mouse-over it, I probably wouldn't object.

>The rest, `item?id=24156986`, is meaningless to a human

Removing Url's is throwing the baby out with the bathwater though. Take Stack Overflow for an example:

https://stackoverflow.com/questions/53302536/vue-test-utils-...

The only thing you need to actually get to the question is https://stackoverflow.com/questions/53302536, but they intentionally add an extra human readable section for laypeople.

If google actually cared about making the internet a better place, they would simply rank human readable urls higher than non-human readable ones.

But this human readable section of the URL is primarily useful for reading outside the address bar, before you've loaded the page.

Eg. if someone pasted you the URL, you can kind of get an idea of what it's about by reading the URL in your instant messenger or something. Once you've loaded the page and the URL is displayed in your address bar, you'd be looking at the page itself to understand it rather than your address bar.

That extra human readable section is not added for humans. It’s added for SEO. That is, for Google.

It's more complex than that. Google upweights it because text in the URL is assumed to be significant to the user. So it's a bit of both, really.

It would be a shame if URL text loses its SEO value because it's getting hidden. Slugs in the url are human-friendly and should be encouraged.

The URL structure is usually mirrored on the actual website by way of clickable breadcrumbs or as navigational information architecture.

People understand slashes indicate folders and directories, even though database-driven CMSes do not use folder structures. They can figure out that they can go one level from from "example.com/cars/toyota" by removing the "/toyota"

> That extra human readable section is not added for humans. It’s added for SEO. That is, for Google.

It is indeed for humans. After all, the whole purpose of SEO is to show up on the 1st or 2nd SRP for web searches conducted by humans.

These are for SEO not for users navigating on the page. It wouldn’t be practical for the user to read information there as they are navigating the page anyway.

> many URLs are meaningless to humans past the domain.

I'd argue this confuses meaningful with degrees of legibility. And also that it ignores how certain significant margins of users do learn this stuff.

`item?id=24156986` is immediately meaningful at least at one level: you know at some level you're looking at a specific item resource under the domain news.ycombinator.com. Processing which one requires a lot more attention and you're probably not going to build up a mental directory of corresponding numbers with discussions, and so that particular meaning passes beyond the threshold of legibility, but that doesn't mean the number itself is meaningless, anyone who's made a habit of paying attention to URLs knows what it is, just not that final layer of correspondence.

And it is not just web developers who know this stuff. I've seen laypeople who are just longtime browser users who have a pretty good idea how URLs like these work, not because anyone formally taught them how paths and query strings are spec'd, but just because the affordance of the URL bar is there and they've seen enough URLs correlated with browsing behavior to learn it by observance/association. The same way most people pick up language itself.

The URL bar teaches some people who care to notice how URLs work, which makes URLs work better as a social tech. And it doesn't require anyone who doesn't care to do so.

We lose that if we remove it. It's not a small loss.

I think these are the only meaningful usecases:

- differentiating homepage from not-homepage

- differentiating subdomains when folder structure is used instead of a subdomain

I don't agree at all that the URL is meaningless to humans. If I want my friend to read this page, I copy the link and send it to him. That ID above is clearly the comment page ID. I don't have to see the backend code to know that.

I'm certainly not an average user, but I am a human. The URL on nearly every site gives me all sorts of information.

this change to the browser doesn't prevent you from copying and pasting. The URL reveals itself when you put focus in the location bar.

Yeah, but you're going to copy that URL to your buddy. You're not going to read it out to him.

You'd be surprised how often people read URLs to one another over the phone.

As an example of semantic URLs, think of Wikipedia articles (ironically, featured in the article). The URL tells you directly what you're reading about. Why is it useful to show it in full? Because page titles are no longer visible during usual browsing sessions - they're shown in tab headers, which means in practice, you only get to see a favicon and maybe a word of the title if you're not a tab hoarder. So once you've scrolled halfway through a large article, the URL bar serves as the indicator of what you're actually reading.

The same applies to news sites, magazines, blogs, Reddit, social media sites - which is quite likely the majority of browsing done by normal people.

I think you've identified some meaningful next steps to try after highlighting that the origin is the most significant part of the URL. Maybe the omnibox space can show the page title?

<title>https ://totally-your-bank.com/</title>

The 24156986 is semantic though; the ids are assigned sequentially to submissions. Early submissions have tiny ids like 495. So they are at least as meaningful as bug tracker ID's or version numbers.

Now, it is true that version numbers etc. could be more meaningful. Jeff Atwood wrote an old article about the "infinite version" in Chrome, where the version number basically doesn't matter until you're checking to see if you're up-to-date. Personally I've switched to using dates / times in my ID's. HN could do that too; an ID like 2020-08-14-10-12-13-99 is longer than the current ID's but not by much. But overall it seems hard to draw a line in the sand where dates are semantic and version numbers aren't.

That's still not semantic though, hn isn't a linear log. It's a tree. Linking to comments by I'd isn't really useful

It isn't meaningless to all humans - we get screenshots sent in to our support team all the time, and even if the end user doesn't know what the URL means, the support team does. That quickly lets them recreate problems, find bad data, and give the devs enough information to reproduce bugs.

> If we could perfectly know which URLs have useful semantic information for users and which don't, and then only present those with full semantic meaning, I wouldn't mind much.

That's a very large if, IMO. We cannot do this, practically speaking.

Even in semantically meaningless URLs like the one in your example, there is still an important part of semantics retained and that is identity. By having the URL available you can at least compare two URLs and judge whether they are the same URL or not. Additionally, there is a 1-to-1 association between URL and content: for each unique URL, you get some unique content.

I agree there might be some UX improvement possible here, but faced with the looming threat of Google AMP, it's not a time to twiddle our thumbs and idly fantasize about this without a complete and robust plan on how this improvement might be done.

I also think that by hiding the URL we will make ordinary users even more ignorant about how the web works. It will truly appear like magic, since they will see identical strings in the URL bar yet they will be served different content. How does this even work? No one knows! Expect users that won't even know how to copy a link to someone.

I like Firefox's current strategy of making the root domain brightly-colored and the rest of the url less-so.

"many URLs are meaningless": many, but not important ones such as URLs from Reddit and GitHub.

Excellent point. But the information I want before going to a URL is different from the information I want while there. But if we could reliably separate the two, I don't think I would object to this kind of a UI change in principle.

this site is fine since these are submissions but its so satisfying when you can just edit parts of the url and go directly to the date and category you want

> For an example, look at the top of this page. The only semantic meaning in the URL for this post is `news.ycombinator.com`. The rest, `item?id=24156986`, is meaningless to a human.

I agree, but I'm going to say the unpopular thing: HN has problems and is an archaic design from the past, and this issue is due to the proliferation of changing the titles of posts (thereby breaking a vanity URL) or changing the URL that the story points at to some other website. Using a vanity URL doesn't work for how the owners run this website and its my belief that it's in the minority along with forum (phpBB e.g.) websites and does not represent the larger percentage of the internet using vanity URLs with human readable text strings in them.

It easily could, even with title changes -- just keep a history of them and redirect to the latest title. Dropbox Paper does this pretty well.

While many URLs are not designed for human consumption, many are, and many users are "trained" to some degree to understand them. But most importantly, users need some visual (or auditory, if sight-impaired) cue as to what kind of site their on, what domain at the very least. That's why HN puts the domainname of the authority of any posted links next to the title.

Regarding URLs that are not designed for human consumption, if they can possibly land in the status bar, then that's on their designers. Yes, of course, that's exactly what malicious players will do: design URLs that users can't parse -- but that's no reason to hide the bar altogether, but rather to hide parts of the URL (e.g., the scheme, the credentials, maybe the fragment, the query, even the path -- everything but the authority).

But then again, you could argue, that URLs are meaningless to people. They are just some weird text and have neither face nor voice.

I am not sure what google tries to accomplish with those changes. Somehow it feels like some UX designer has made this his personal vendetta. Didn't they try it already some months ago and got pretty clear feedback?

If this is about phishing, who established the theory, that people who don't understand URLs, understand how phishing works and that even the slightest deviation in a domain is dangerous?

> I am not sure what google tries to accomplish with those changes.

I think it's about the ways people can and do navigate the web.

It's something you don't need if you navigate the web just via Google, so they get rid of it.

not only are some URLs meaningless, they can in some cases be intentionally misleading. by hiding the non-domain portion of the URL, google is showing the only actual authoritative information contained in the URL: what site is hosting the page.

/r/webdev disagrees.

item?id=24156986 is readable and meaningful

It isn’t meaningful. It’s effectively a pointer. Pointers point to meaningful data but mean nothing by themselves.

The only real use the path has left on a URL is as a permalink sometimes and for non-computer people it's not clear at all when it is and isn't. I've been sent to many "did I forget to get anything" texts with a link to somesite.com/cart.

Not to laypeople. Most people have no idea what query params are, or even what part of the url the top level domain is. You can explain what they are easily, but it still wouldn't be useful to laypeople. What can my mom do with "item?id=24156986"? Outside of developing something that interfaces with HN, I don't know what I would do with that info either.

A layperson wouldn't know what the "7394" in "7394 Foobar Road" means or why "Foobar Road" is a road called "Foobar" but that does not mean we should give Google the right to eliminate street addresses.

A URL is an address. All your mom needs to know is that if she goes to https://news.ycombimator.com/item?id=24156986, she will end up at something and she will be able to come back to it later, that's what's useful about it. And besides, there are URLs that are semantically useful, such as reddit's "u/username" or "r/subreddit" schemes.

Of course, the URL is being assaulted from two other fronts, with websites turning into single page apps and with social networks constantly making it difficult to share URLs.

Funny, I actually can't thing of anyone under the age of 30, lay or otherwise, who hasn't figured out that odd looking string in the URL bar is the name of the web page. They then rapidly figure out if they want to share that web page with a friend, all they need to do is send them that string. I don't know how they've learnt that, but I'm guessing seeing it they are the top of on every web page must be a bit of a give away. If that doesn't give it away, they first time they have to copy and paste a URL it probably dawns on them.

Beyond that, just about everyone who has used ebay for a while only cottoned on to the item number being the magic thing that identifies an item for sale. Nothing remarkable in that of course as ebay has it everywhere, but then most go on to figure out that https://www.ebay.com.au/itm/Bathroom-Acrylic-Free-Standing-B... and https://www.ebay.com.au/itm/254579100447 are the same thing.

Shorter version: you say people don't notice patterns when they see the same thing over and over again. I've don't think I've met anyone under 30 who doesn't. And once they've noticed, they then exploit the patterns to their own advantage.

Don't think for laypeople, think for yourself, you're an expert in computers, you know what is better. The laypeople will benefit from your expertise.

The laypeople are not idiots, they understand things, in particular referencing an item by ID.

How is Hacker News item 24156986 that different from say Harry Potter and the Goblet of Fire page 134? Even ordinary people can understand numbered things with info on.

Wow - top posts are conspiracy theories. "The only reason to do this..." "This is a security issue..."

Google has millions / billions of users. From a security standpoint the focus should be entirely on the root domain, that is the only really meaningful root of trust.

If you are talking about a security issue - the KEY security issue is ANY lack of clarity around root domain.

"Showing the full URL may detract from the parts of the URL that are more important to making a security decision on a webpage." is a statement they have around this change.

I think I agree - I suspect other browsers will have to copy chrome (again) in de-emphasizing the leading URL (often used for fishing).

Folks seem to miss the fact that google chrome was a minor competitor initially it IE - and their focus on things like ... security ... helped them become absolutely dominant. A fair number of enterprises have (finally) started slow slow switch to mandating chrome.

My first thought when reading this was relief... For my mother.

I've spent most of my adult life trying to teach my parents to look at the address bar to make sure they're on bankofamerica.com and not some random phishing domain. That kind of falls apart though when it's... bankofamerica.comm.phishingdom.com/{random filler}/bankofamerica/user/login

HN users are fantastic at thinking all technologies should revolve around their niche use case.

The root domain is highlighted in FF. This must be enough for visual testing.

If you want a more reliable approach then you need to work with a whitelist and clear warnings.

I wouldn't assert it without strong evidence. This URL comprehension problem is probably more complex than what people usually think. There are a number of studies about this issue, if you're interested.

https://storage.googleapis.com/pub-tools-public-publication-... https://kumarde.com/papers/urls.pdf

> The root domain is highlighted in FF. This must be enough for visual testing.

I've been using Firefox for years and never realized this. Looking up at the top of my browser, I can see that "ycombinator.com" is highlighted and the rest of the URL is a darker grey. To me, this seems like a good compromise; you still get the full URL but the important parts stand out a bit more.

Exactly - also if you do any penetration testing of your staff side - the key to get something through is have the name of the company it seems anywhere in the URL. Literally - lkjljkdfskjfsd.com/bankofamerica/securelogin.do etc.

Part of the issue I've noticed is some sites actually do outsource things to other sites (microsoft has a lot of redirects on logins so you used to end up on passport.com I think to login, and then to something with azure, then office... etc). Combine this with subdomains and trailing urls and internationalization efforts and you are in trouble.

This must be just because of how we scan / read things? Ie, a quick cross check. A lot of people maybe don't parse all the elements properly (,.:?& etc).

The other issue - let's say just 2-5% of chrome users are confused. That still is a HUGE number that are confused.

It looks like non-trivial subdomains will still appear and those seem to me to be the most problematic.

> their focus on things like ... security ... helped them become absolutely dominant

I don't think Chrome's security features had anything to do with its ascension. Chrome took off because it was fast and had a good UI (iirc it had the ability to drag a tab from one window to another, a while before other browsers did).

The average user knows nothing of the security features of their browser.

Also you couldn’t use google search in a different browser without constantly getting harassed to install chrome

Chrome took off because Google leveraged their position in another area (search engine) in order to push it. Exactly what people were concerned about with Microsoft and Windows/IE.

That's not the whole story. Plenty of people moved from Firefox to Chrome, because they found Chrome to be the better browser.

It did in a domain I'm familiar with.

I think they were the first to have separate processes for tabs (?) which you could really see add robustness - when flash could blow up your session etc you could much more easily close out the offending tab.

They were stricter and more prompt in blocking things like activex controls, they'd remove features tabs would use to try to take control of your session or confuse you. All these enhanced security and usability.

There's no disagreement here. Chrome brought lots of good security enhancements, and raised the bar for other browsers, but security isn't the reason people made the switch.

Yes, Chrome was the first to do process-isolation. As for ActiveX, I believe that's generally only available through Internet Explorer (not Edge), I don't think Chrome ever supported it. [0]

[0] https://en.wikipedia.org/wiki/ActiveX#ActiveX_in_non-Interne...

The degree to which HN is obsessed with AMP is hilarious at times. You'd think every single one of the 100k engineers that work there do nothing but dream up ways to trick people into using AMP for some secret illuminati end goal.

If you don't like AMP, that's fine. If you don't like this UX change that's fine too (and I suspect will be easily fixed with an extension). But maybe consider for a moment that not every single UX change to a product with a billion users is part of the vast AMPiracy.

You say this as if those engineers (and it's not 100,000) are all voting in a democratic decision-making process on feature direction. It's a very small number of senior leaders who make these calls.

Remember, Sundar used to be in charge of the Google Toolbar. That was his claim to fame inside of Google before Chrome.

I'm all for balanced debate, but strawmanning doesn't help anyone.

How this this a straw man? Parent is just agreeing with gp that a lot of HN users are obsessed with AMP and it’s supposed evils

Disclaimer: googler opinions are my own

The strange part there is that this is mobile Chrome following the mobile Safari UX which has never been criticised like this. It's just bizarre.

Even desktop Safari does this by default! And yet no one was outraged.

i think its because apple isnt trying to mitm your web browsing with some amp-style service (yet)

Apple users choose to get a system that does different things that restrict them in non-obvious ways. Those people are not going to complain much.

Chrome is the default option for browsers. People don't really choose it anymore.

Considering most techies have iphones and macbooks I can’t make sense of your comment.

They could emphasize the FQDN without removing the URL.

People (at least some %) just trigger on see the company name in the bar - if I gave a pop quick to all your relatives do you think they could accruately manager to describe all the separators and what they mean? ?&/: etc?

They've wanted to remove the URL for AT LEAST 6 years - it's been a well known issue inside google that URL's dont' do a good job showing orgin info.

Didn't they have the origin chip idea way back?

They've been doing this (showing the rest in grey) for a long time.

> Folks seem to miss the fact that google chrome was a minor competitor initially it IE - and their focus on things like ... security ... helped them become absolutely dominant.

Security is a very small factor, if a factor at all, for Chrome to have become dominant. The main reason is because they keep/kept pushing everyone to install Chrome when you visited https://google.com (by showing you a small popup window).

Microsoft had IE as the DEFAULT - and did plenty of pushing itself.

Across almost all dimensions chrome was better when it came out - people seem to forget how horrible browsers were historically (and how easily abused). I know ages ago of an entity that just got tired of dealing with the problems folks caused not using chrome (whether it was chrome's website blacklists or whatever - folks using chrome were less likely to get ransomeware - period). Literally - EVERY install of crap seemed to be coming from IE users, except one case I know of where someone had a chrome extension change hands and go rouge.

Do you have evidence?

Because I remember trying Chrome and immediately switching because it was miles ahead. So did my friends. It was faster and had slicker UI.

Nobody keeps using a shittier browser no matter how many times you shove it on their faces.

Btw Chrome is still faster than Firefox for stuff that matters and often by a considerable amount:

https://www.phoronix.com/scan.php?page=article&item=chrome83...

Domains are only a meaningful root of trust if they're tightly controlled by a small set of people. A piece of content being on 'news.ycombinator.com' or 'github.com' literally tells me nothing about how trustworthy it is. In the case of yc, i have to look at the poster, and the actual content, and the replies to it. For github, I have to look at things like who posted the code and which repository it's in - both things that are displayed in the URL, oddly enough...

Google's URLs are of course long strings of useless hex/base64 garbage, so it's natural that they want to hide them.

100% false. If you login to news.ycombinator.com it's unlikely you are logging into a fishing site for ycombinator. If you login to github.com - again, very unlikely github is running a phishing scam on you.

Do folks not understand the importance of this?

Google has not only become dominant because their product is good. First and foremost, they leveraged their market power through android and their search engine to get people to use chrome.

As another said -- chrome was dominant before Android was a player.

Firefox blew a hole in the IE wall. Then chrome came along and was more acid compliant, leaner (Ux/ui), faster, and it's approach of per-tab processes was superior to a lock-up prone Firefox, or IE.

Firefox required admin rights to install on Windows, what locked most of the user base out of its reach.

Chrome got his market by silently installing as the IE rendering engine, and by being bundled with other software.

Lol ? You do know Android was nascent when Chrome became dominant.

They could just color it differently or show it in bold text.

Hiding the rest is clearly motivated by something else.

at what point is not any longer? Once the URL bar has gone?!

"Conspiracy theory!" has become a term for dismissing genuine concerns.

So the theory is that this is part of Google's evil plan to make it impossible to tell the difference between an AMP page and the real page because the next step is to remove the URL bar.

Given that this change makes it plainly obvious what domain you're on... Now tell tell me if this is a genuine concern or a conspiracy theory.

The title is misleading and people don't read the article.

Chrome is not hiding the bar address, it is only showing the domain in normal times, and showing the full url when you hover the bar

Personally I find it better for non technical people, because they can focus on the domain only. For tech people you have the option to keep the full url visible at all time, which fixes the issue.

As for people complaining about AMP, this is something different, which has nothing to do with displaying only the domain, but instead "showing the real domain when you are on a google AMP page"

> Personally I find it better for non technical people, because they can focus on the domain only. For tech people you have the option to keep the full url visible at all time, which fixes the issue.

I think a large part of my repulsion to this change is mostly because Chrome has a history of removing options constantly. A weird default with a setting to get to more expected behaviour is fine, but I have no faith in them to not remove the full url visible at all time option at this point.

Sounds about right... I am still cheesed that they're treating the address bar like where you search. For me, if the address bar does happen to go away, so does chrome.

Sorry but if you can't teach non technical users new things they shouldn't be 100 meters near a computer.

It will result in even more technical dept and people with over confidence thinking that they know what they are doing.

We don't need to idiot proof the world. We need to educate the idiots.

Unfortunately this doesn't scale to a billion idiots

I already have the "Always show full URLs", so you know what I prefer, but isn't this the same or similar to Safari's default behavior for a while? I don't hear anyone still complaining about that.

They're just trying to prevent phishing. Remember when the DNC was hacked?

Employees at the DNC were linked to sites that looked exactly like the Google sign-in page, except that the URL was "myaccount.google.com-securitysettingpage.tk".

picture of the phishing website:

https://security.stackexchange.com/questions/189688/does-goo...

From interviews, it seems like there's two features Chrome developers are working on try to prevent these kinds of attacks. One is to hide the subdomain so that people can't make such tricky looking URLs. Another is feature to identify lookalike URLs and let users know about the anomaly.

sources:

https://www.nytimes.com/interactive/2017/01/06/us/russian-ha...

https://p3isys.com/p3isys-tech-blog/153-podestahack

https://www.wired.com/story/google-chrome-kill-url-first-ste...

How exactly does it help to prevent fishing from domains like my-google-account.tk?

(Disclaimer: Work at Google but not affiliated with our security team or with Chrome.)

Those URLs have to actually contain the name of the brand in the thing that is being registered with the domain registrar. Which is a _lot_ easier to find and proactively shut down than things in subdomains which may only be visible once a specific URL gets resolved (wildcards etc.).

If they hide the subdomain, then if users see google.com at the start of the URL it will actually be google.com. Tricky URLs like "myaccount.google.com-securitysettingpage.tk" would get displayed as "com-securitysettingpage.tk" instead.

I get emails from some banks with instructions to spot phishing. One of those is to look at the full URL in emails or on websites to know if it’s authentic or not.

For better or worse, the URL scheme is what we have to identify websites and pages. Hiding that on larger screens doesn’t make much sense. It also hinders learning for the next generation.

Actually, that's their argument for doing it. Most users don't understand the different bits of a URL, to know whether it's from the site they think it's from. See (huge) previous discussion from two months ago: https://news.ycombinator.com/item?id=23516088

Personally, for my own purposes, I think hiding any bit of the URL is incredibly inconvenient. Already hiding the www. is seriously annoying. I will switch this new behaviour off and hope they don't remove that option.

If that's really their justification, then I wish they would take the approach that Firefox does - show the full URL but have the domain name in white and the rest of the URL in a muted color. It provides the full information as well as highlighting the most important info for spotting a phishing scheme.

It is not just inconvenient, hiding or modifying URLs is a lie and is a security problem. Hiding part of the URL means that you don't really see what's going on, and that is the first step towards a security problem, not away from it.

> Actually, that's their argument for doing it.

If AMP didn't exist I might be slightly more inclined to believe them.

I didn't know there is an option to change it back, thanks for pointing that out. I've found it really frustrating when trying to copy different parts of the URL.

Just fyi, the google chrome plugin "Suspicious Site Reporter" reverts the url back to how it always was, with http:// and www and everything else. It's very lightweight and you can just leave it on, don't have to report anything or do anything with it.

Hopefully it remains this way _forever_, even with these newer changes as well.

Embarrassingly I let checking the URL bar give me a false sense of security and got phished for the first time just a few days ago. They put a fake URL bar into the page and made it look like a proper OAuth2 URL. (My 2nd factor saved me from giving them access since it slowed me down enough to notice some subtle oddities, but I still had to change the password since that was already submitted)

The real protection against this is making it impossible for me to send credentials to the wrong party. Normally my password manager helps with that, but I had just switched managers a couple days before and it wasn't recognizing all sites properly (likely due to the lack of a database of known equivalent URLs). If the site was using WebAuthn, there wouldn't have been any issue because the imperfect URL checks by me and the password manager would not be necessary.

The bank may say that, but it's not actually good or practical advice.

Countdown until scammers figure out a way to screw up the parsing code and get Chrome to show the incorrect fake url

This has been the standard on safari for years. Are you saying that people who use safari suffer from those problems?

Remember folks, Apple has been doing this in Safari since 2014. And there's been zero uproar over it at all. I don't understand why people suddenly hate this just because it's Google.

For most users, total focus on the domain name is a security feature. For 99% of users, what comes after the domain name might as well be gibberish. I mean, it is a majority of the time.

The first time I used Safari and didn't see a full URL was the last time I used Safari. I didn't raise a fuss or take to twitter, I just stopped using it. I'm probably not alone.

In addition, Safari has a very small slice of browser usage in the overall scheme of things. I suspect the uproar would be just as vocal if their usage numbers were in the range of Chrome's.

Same here. Recently I though I'd try out Safari again. Started browsing reddit and kept forgetting what subreddit I was on. It was then I noticed something was wrong.

You can enable the full bar though, instead of not using the browser anymore...

Google has been doing this since 2010 [0]. Weird strawman.

0: https://bugs.chromium.org/p/chromium/issues/detail?id=41467

That’s only hiding the protocol part of the URL. Parent is referring hiding everything but the domain, which the article in question is about.

Weird strawman.

Fair enough, thanks for the correction.

When the final version is implemented in a couple of years you will no longer see any URL, that way it won't be as evident that most sites on the web will be loaded from Google.

Google is also attacking this issue from a different perspective with Signed Exchanges [1][2], to fake the URL and ensure their success in becoming the gatekeepers of the internet.

If you refuse to become a content provider for Google's vision of the web, then they currently won't feature you at the top of search results in the Top Stories carousel, and perhaps demote you entirely from the first page in the future, depending on how their hijacking strategy works out.

[1] https://news.ycombinator.com/item?id=19678693

[2] https://www.iab.org/wp-content/IAB-uploads/2019/06/mozilla.p...

Yeah the endgame would involve a play-store like 30% cut of any revenue, subscription, ads, anything. 30% cut from non-Google ad network revenue as well. At that point publishers won't have a choice any more because of the Chrome and Google search monopolies.

By that time it will be warranted to limit user freedom on the web to make security and privacy accessible for everyone, just like Apple does today on their devices. The scary open web and the meaning of a general purpose computing device will be easily forgotten.

I think the easier version of that is AMP gets favored and AMP only serves Google ads. I never really thought of that being the endgame, but it makes a lot of sense now that you say it.

Off-topic hysterics

I wonder how bookmarking and auto-complete work with signed exchanges. I don't think they could ever remove the URL completely because it conflicts with their extortion scheme for AdWords where they'll sell your trademarked words to the highest bidder.

What happens if Chrome shows no URL and Google sells the AdWord for your bank's name to a malicious actor? That's a huge liability can of worms IMO.

I'm not sure the signed exchanges are all bad either. I'd rather have visitors seeing example.com than example.google.com/amp/ or google.com/amp/example.com. Isn't it better for your brand to be in the URL and bookmarks / auto-complete to go to your domain (assuming it works like that)?

I'm not convinced the whole web identity push is 100% bad. I don't trust Google, but as a general concept I think there's some technical merit in the idea.

> to fake the URL and ensure their success in becoming the gatekeepers of the internet.

They should just buy Cloudflare

Jake Archibald (a Googler) presents some decent points on this on the HTTP 203 podcast: https://youtu.be/0-wB1VY3Nrc

I still don't agree with the removal of URLs, but I do still recommend watching the entire video if you want to get more perspective on the issue (beyond just the conspiracy theories about AMP and control).

For now I'm quite happy to have finally switched to Firefox a few months ago.

If Firefox disappeared though, as it seems it might, that would be horribly frustrating.

Firefox/Mozilla is largely funded with the search deal which is usually paid by Google.

Google has a vested interest in Firefox staying alive for competitive/monopoly reasons, especially now that IE is official a Chrome skin.

e.g. https://www.forbes.com/sites/barrycollins/2020/08/13/mozilla...

Wasn't the last days' layoffs direct consequence of that deal expiring later this year?

Nobody knows, since we dont know if the deal will renew

If you have a Mac safari is quite good

And for those of us who still compile ff from source and remove/add things as we please, we'll have to see people moan about something they always had and will continue to have control over, but long ago rationalized away seeking comfort in the chaining of their minds to things/ideas that are foremost in the best interest of others and not themselves.

/me shrugs

If you have such complete control over your applications, why do you have to see anything you displease? Just add a filter to your Firefox that removes such complaints before they are displayed.

Well, I have to make a living catering to people (on mostly my terms and my time frame) complaining about things they have no intention of trying to do anything else about… seeing the complaints and lack of solutions adopted is a good sign for a captive market :P

I still haven't found a good answer why they do this. "Makes it harder to tell if the current site is legitimate" sounds like an excuse. If you are the perfect target for a phishing attack (= clicks on everything, enters passwords everywhere, has no clue about host names) then you also won't be able to understand what Chrome presents you in the address bar after obfuscation.

My best explanation so far is that the Chrome team doesn't know how to improve their browser anymore so they just make up work to keep the software engineers busy.

Trying hard not to sound like a conspiracy theorist. However, it's pretty obvious this benefits a walled garden strategy. With things like AMP, "rich snippets", etc, they keep eyeballs on Google owned properties longer. Slowly deprecating urls over time makes it less visually apparent.

AOL was able to sell "keywords" this way, because it wasn't always obvious to their users how to get to the real internet.

It's not a wacky far-out conspiracy theory to notice that Google is attempting to dominate the internet. It's a serious problem that we need to do something about before it's too late.

I think the justification is that some people will think the website is legitimate if a legit hostname appears anywhere in the URL e.g.

http://scamsite.com/microsoft.com/phish

"looks" legit because it contains the string "microsoft.com" (and most "regular" users won't appreciate the different parts of a URL); under the new scheme, that would display only as "scamsite.com" and hopefully people are less likely to enter their microsoft username/password if "microsoft.com" doesn't appear anywhere in the address bar.

I'm not overly convinced of this personally, but I think that's the supposed idea behind it.

I think microsoft.scamsite.com would fool most of the people that scamsite.com/microsoft would. It's a very difficult problem. Can't we have something like certificates for domains, so we can at least trust the most potentially vulnerable cases?

In my experience companies are pretty bad at always using their own domain even for legitimate things. I suspect it is because getting IT to do something like setting up a subdomain in any company I've worked in is virtually impossible, whereas buying a new domain is easy.

So I think most users wouldn't think something like `microsoft-it-support.com` would be suspicious.

From an advertising perspective if the cost to serve amp is less than ad revenue, this makes perfect sense. Every click on google goes to google, and you’ll like it too bc you won’t have a choice.

> “Makes it harder to tell if the current site is legitimate" sounds like an excuse.

Why? To me, having helped elderly relatives with computers a lot, it is very plausible. Phishing URLs use all sorts of subdomain and querystring tricks to fool users, and it can work.

As someone noted, not only that. But you won't see on which subreddit you are at for example. That's quite annoying.

IMO this is the real reason why they're pushing hard towards this:

  However, it's also worth considering that making the web address less important, as this feature does, benefits Google as a company. Google's goal with Accelerated Mobile Pages (AMP) and similar technologies is to keep users on Google-hosted content as much as possible, and Chrome for Android already modifies the address bar on AMP pages to hide that the pages are hosted by Google.

We are going back to AOL days. That didn’t work out so well for AOL in the long run. It’s kind of crazy to me you can’t do marketing now without at least discussing Google and Facebook these days.

Edit: at least you knew you were the customer with AOL and paid them with clear terms for access.

The only difference is that Google has endlessly more clout and depth than AOL and my fear is that where AOL failed, Google may succeed.

With Firefox succumbing this week, this is pretty horrible.

I’m not a Richard Stallman type, but I think it’s come to the point where if you have even the slightest pretense of being a “free web” person, using Chrome or a Chromium-based browser has become unconscionable. This company is playing embrace extend extinguish to a T and they are nearing the end game.

I switched to Firefox this year and so can you! Just download it, install it, and then clear your Chrome history so it doesn’t feel like home anymore. Firefox is really nice and I was surprised that I don’t miss Chrome at all (except for the developer tools color picker).

The comparison to AOL was my first thought also.

Basically, Google have lived long enough to see themselves become the villain.

I dunno, AOL was extremely successful and people loved it. I'm not ashamed to say I liked it, having everything in the same window. Google could only hope to achieve that fluidity. Messaging, Email, and web all in one workspace.

AOL really only declined because of the rise in high speed internet, and their awful business model and practices.

AOL had a particular mismanagement problem that Google doesn't have.

AOL didn't lack depth: they literally had email (@aol.com), social media (AIM), video-calling (Vonage), cloud filesharing (Xdrive) and so much more.

Ultimately, they failed because (1) they were overvalued to begin with and (2) had a bad innovation model (top-down) that led them to (a) over-commit to online ads and (b) under-commit to broadband.

Google is sustainable & mature, and it has a distributed innovation model that will avoid the particular mistakes of AOL.

Google is reacting to the Walled Garden trend, not driving it.

Do you or anyone else have a video or screenshots of what you're talking about? Or is there a specific name of the product where AOL was doing this?

This is off-topic slippery-slope hysterics that have nothing to do with the story

It seems like we've reached that already. I've seen TV ads where they just say "Search for $KEYWORD" instead of a URL (admittedly that's more average-user friendly than making them input dots and slashes). Or posters that have [f]/someFacebookPageName or [i]/instagramUsername with the icons to indicate Facebook/Instagram.

I encourage everyone to use Firefox on Android just for the one killer feature of being able to install the full desktop ublock origin plugin.

The recent mobile Firefox is worse in every way that matters to me:

  ° Breaking recent add-ons (for the few add-ons that exist). I added a close-tab icon to compensate for the bad tab-ui. It's gone now.
  ° URL-bar hiding is wonkey. Some overlays disable hiding due to recent phising attacks. Now, for overlays, it is always present and hides the bottom of the page. This is very annoying when links are hidden behind the bar.
  ° URL bar (2): where have my bookmarks gone?
  ° URL bar (3): no more editing the URL if anything was *ever* searched in the current tab. Instead it edits the search. The URL is inaccessible. 
  ° After 'Open in new tab' there is an annoying delay for 'Switch' again hiding links.
  ° Tab selection is just bad now. Preview is broken. If anything is displayed, it is often the image of two sites ago, even if the page has rendered.
  ° Tab selection (2) no more moving the tabs?
  ° Tab selection (3) why waste so much space? Using only 80% of the screen. And every tab wastes two lines and a half of useful space. Why is only the domain shown? Why not truncated or cut in the middle? 
  ° Tab selection (4): newly opened tabs are hidden, you always have to scroll up as the current tab is always first, older tabs are lower.
  ° about:config is broken. Certificate error. Certificate error is broken too. Thus no disabling reader mode.

These are papercuts, every day, every time I use Firefox. /rant

Yes!! When I see other people browsing on Android without uBlock I'm in awe of their patience.

I tried. Tab switching was - for me - horrible compared to Chrome (chrome:swipe down, swipe address bar down, select tab you want from carousel).

I kept looking if i missed this obvious feature. I tried to live without it, but Firefox mobile's tab switching just turned out to be a deal breaker for me.

If anyone had some tips: please!! I'd vastly prefer using FF on mobile.

when you have blokada, ublock doesn't make much sense.

why block ads on a browser when you can do it on a system-wide level.

unless you need the vpn connection for work or something like that.

With Firefox axing the entire Servo team along with a bunch of other technical people, I am very afraid for its future in terms of technical development. Especially for the macOS version, that so far has always been the red-headed stepchild.

It’s got me in quite a pickle since the only alternative that is privacy friendly and cross platform (macOS, Linux, iOS, Android) is Brave, and Brave, despite good or at least decent intentions, has done some questionable things.

I don't think this is true at all. If anything, this change actually hurts AMP because now none of the original host url is visible at first.

I don't like browsers that do this, its the first thing I turn off in Safari, but how does Apple manage to get away hiding the full path under positive intent, but when Google does it its because they're evil?

I think it's pretty fair to say that the wider population of users aren't very good at determining which part of the URL is the authority, so any change to help with that can only be positive imho.

> I don't like browsers that do this, its the first thing I turn off in Safari, but how does Apple manage to get away hiding the full path under positive intent, but when Google does it its because they're evil?

I don’t like it either, but I assume the difference arises from the fact that Google would benefit from deemphasizing the URL and has done work already in faking it, while Apple probably does it because it looks clean and it thinks its users will be tricked by apple.com.help-virus-14682825821&824826.

To play the devil's advocate, Apple's Safari has been hiding full addresses for quite a while, without having any direct benefit as a company as far as I know.

It only does this on mobile, as far as I can tell; using desktop Safari as my primary browser, I'm not seeing this.

Apple has it's own goals of hiding technical information from the user.

hmm, the only thing it hides for me is the protocol, and that one is easy understand: a padlock shown: https. "Not Secure":http.

Safari has little to none marketshare.

It need not be malice. It maybe because the design people think people are too stupid to understand URLs.

As other comment mentioned, Safari does it too.

The trend seems to be abstracting away stuff like filesystem. Many people I know don't even organize stuff into folders on their phones. Everyone seems to dump everything in Download or something like that. The existence of separate applications for Music, Video and Photo content makes it irrelevant to some extent.

> It maybe because the design people think people are too stupid to understand URLs

You may be right, but it's hard to see why this would be a concern in 2020. The number of users who have actually grown up with URLs in their childhood increases all the time.

If that conspiracy theory is true, what reason does Apple have to do this exact same thing on iOS Safari?

It looks marginally cleaner.

Specifically how does this change benefit Google?

The security problems that it addresses are very concrete and specific. I can clearly see how this change helps novice users.

How does this change benefit Google? It seems very hand-wavy.

Edit: downvotes, but no explanation of any specific benefit to Google from this change

It's been explained elsewhere in the thread.

Seems unlikely, considering they're also pushing for signed exchange (SGX) which also does the same thing.

Reason number 368 why I've moved everything to Safari + DuckDuckGo. I still can't believe they won the suit with Genius and being caught poaching their content for their own representation

>AMP

Tangentially related: on mobile, I've been having a good time with Firefox with this plugin: https://addons.mozilla.org/en-US/firefox/addon/amp2html/

A good anti-trust investigation and subsequent break up of the company should fix this problem.

> Chrome for Android already modifies the address bar on AMP pages

How does it do this? The URL looks totally as I'd expect (google.com/amp/) - I'm on version 84.0

They are boiling frogs: https://en.m.wikipedia.org/wiki/Boiling_frog

Little changes over time, so you don't see the end game right away. Signed exchanges and further hacking up / hiding the URL will come. This change only hides some of the URL, with a hover action that shows it again.

Requires implementation from the amp site as well I think, but here's the spec they introduced to allow for it: https://caniuse.com/#feat=sxg

It's called signed exchanges.

https://amp.dev/documentation/guides-and-tutorials/optimize-...

You can also use an ad blocking DNS, it's been working great for me

Yep. The Internet is now "The Google."

agreed 100%

Google revenue is slowly going down

Only option for Google is to pretend Internet doesn't exist

Anyone who is using Adwords or doing Search Engine Optimization

look at what results look like

It's 50% to 70% traffic being routed to Google

remaining being routed mostly to people who pay a lot to Adwords

It's almost purely Pay to Play now in most of the lucrative areas

> Google revenue is slowly going down

Perhaps you mean their revenue growth is slowing? Because they're actually seeing pretty healthy year-over-year revenue increases: https://www.statista.com/statistics/266206/googles-annual-gl...

Hasn’t Safari already been doing this for ages with no issues?

The difference is that Google likely has ulterior motives with this change, whereas in Safari, it's purely aesthetic.

Edit: I've just tried it in Chrome (enable [0] and [1] or [2]), and it's a disorienting user experience. As a matter of fact, I also just tried it in Safari, where I have similar complaints (but, again, it's easy to disable there).

[0]: chrome://flags/#omnibox-ui-sometimes-elide-to-registrable-domain

[1]: chrome://flags/#omnibox-ui-reveal-steady-state-url-path-query-and-ref-on-hover

[2]: chrome://flags/#omnibox-ui-hide-steady-state-url-path-query-and-ref-on-interaction

Yes, it has been doing it for ages, both on macOS and iOS.

Safari does something like this (showing the full url only when you select it), and it can also be disabled in the settings.

It does not do anything like obfuscating where the document comes from, like Chrome on Android does to hide the fact that they are serving AMP pages.

Which is the reason why I not use Safari on OS X (additionally, the Safari devtools are atrocious).

This is hacker news, and you're talking about apple.

Yes. They also have ~4-5% browser market share.

I just confirmed that desktop Safari has exactly the behavior this post describes. If I visit any Wikipedia page, what I see in the URL bar is "[lock icon] en.wikipedia.org". The path is entirely removed.

Its an option under Safari/Preferences/Advanced called Show Full Website Address.

My Safari has the full path

13.1.1 (15609.2.9.1.2)

> “Showing the full URL may detract from the parts of the URL that are more important to making a security decision on a webpage," Chromium software engineer Livvie Lin said in a design document earlier this year.

I’m a software engineer, too, but I would never make such an important UX decision because I know that is not my area of expertise.

I hope they’ve gotten significant user feedback on this before rolling it out.

Personally, I hate it.

I wonder if Livvie Lin and other Google engineers read such HN threads. What might be their internal discussions, I wonder.

How do they justify such design decisions? Are they asked by someone else to figure out how to make such wierd things happen as they just do as ordered?

"Asked by marketing" or something like that.

Fucking suits spoil everything. Engineers are in general, more ethical than suits.

Yes, marketing was obsessed with the URL bar all this while.

It's Nanny State rationale at best, or cynical condescension -- I hate it, too. I switched from chrome back to firefox a year ago, with no loss of anything.

Vote with your choices (use a different browser). That's the only way to address such behaviour. Yes, I know the 95% out there who don't even know what a browser is but only know Chrome's icon gives access to the web won't understand any of this and they will continue giving mega-corporations a critical mass of unquestioning users to be used, but we have no other options.

We either express our voices, no matter if they're fringe (and hope it catches on) or we can just give up and not even write these articles any more.

> Yes, I know the 95% out there who don't even know what a browser is but only know Chrome's icon gives access to the web won't understand any of this

I find it fascinating how some people in tech bubbles think everyone else is a stupid sheep who can't possibly understand such incredibly complex concepts like what a "browser" is.

I've met very intelligent people who have zero understanding of computers: they have been trained to click certain icons to be able to reach google for a search. I'd be interested in data supporting either more or less fluency than we might expect - but you wont be able to do an online survey to get it :)

> I've met very intelligent people who have zero understanding of computers

I'm curious - how do you reconcile thinking they're very intelligent with thinking that they're utterly unable to grasp the basic concepts of computing?

And that, precisely, is my point: as an industry we'd rather tell ourselves that it's all so impossibly hard and beyond the grasp of the common person rather than admit that we just suck at explaining things and educating people outside our bubbles.

I spent 6 months tutoring senior citizens on how to use computers (specifically it was word processing).

Believe me... some of the gaps in knowledge are alot wider than you'd imagine. None of them even knew what I meant when I mentioned the "URL bar". These are people who had previously used the web to search, pay bills, etc. To them, "the internet" was the entire computer, and had no concept that the browser was a distinct entity within it.

You're 100% right this is teachable but it is important not to understate the size of the canyon.

People think the screen is the computer.

People think Google is the web.

People think the search engine is the browser.

Depends. I have seen a lot of people who don't understand such things. And I have seen teachers who think using a different editor to write a program might affect output.

> Vote with your choices (use a different browser).

You almost don't even have to. Microsoft's Edge is basically a rebranded Chrome with all of the Google stuff stripped out. You can keep using the same extensions, etc.

This is why we should jump over to Firefox. Today! And by us I mean we who know that this is a bad idea. Mozilla is suffering and this is our last chance to not let Google and chrome have total dominance over the web. Mozilla copies Chrome a lot, but they need more market share to be able to get a say here and take the point of us power users.

I have been using and contributed to Firefox for years, and it is a great browser!

Come on, we know better! Use Firefox or watch Google destroy the open web. It's up to us!

Mozilla has flaws, yes, but this is important! That technical users continue to use Chrome is beyond me.

Google renewed their deal [1] and Mozilla is still going to get 400-450mil per year until 2023 at least. Yet they gutted firefox servo, devtools and MDN teams.

Using Firefox from now on is just feeding the troll called Mozilla management. We need to seek another open source privacy oriented browser or have a serious foundation like Apache fork Firefox.

[1] https://www.theregister.com/2020/08/14/mozilla_google_search...

Stop using chrome. Use Firefox, https://www.mozilla.org/en-US/firefox/developer/.

A nice side effect for them is that it makes it less obvious you are viewing an AMP site.

Do they not have those AMP sites that are under a Google domain anymore?

They hide the fact that it's a Google domain in Chrome.

URLs are supposed to be human-readable because they're intended to signal to users what the content is about.

What is not human-readable, although fully semantic, is all the parameter trash that comes after full URL. Stuff like "utm_source='twitter'&utm_medium='social_share" or cookie information and the like.

I can understand trimming that information, but hiding the URL to show the domain only makes no sense.

The example url in the article is:

> https://en.wikipedia.org/wiki/URL#Internationalized_URL

which is shortened in the address bar to:

> en.wikipedia.org

at the VERY least, I wish they would instead use:

> en.wikipedia.org/wiki/URL

Same for Twitter and Reddit URLs, specifically. Don't hide the username or the subreddit.

Those are two examples where the URL is canonical and shouldn't be shortened.

There are probably many, many more. Very often the only place you can find the date of a news story is in the URL due to them using some version of Wordpress but not putting the date in the article past a certain age (F YOU, Guardian).

Google has clearly thought this through and decided that whatever they're getting out of this is FAR MORE IMPORTANT than the best interests of their users.

And that should make everyone suspicious.

Sigh. Now browsers are as powerful as OSes. Why do you need OSes?

Address bars? People don't need them. Google should tell you which website you're visiting is good or which is bad if they hide the address bar.

I’m not sure why this is being downvoted, this is an accurate albeit sardonic description of what’s happening.

People don’t want to visit AMP sites, they want to visit the site that’s the original source for their news, etc...

I mean, depends who you mean by people? I'm pretty happy to go to amp sites. The thing I care about is the content.

Then you've not used many AMP sites - many do not function properly and try to 'stream' the content as you scroll leading to a garbage experience and missing content.

Yeah, well maybe after they have this power, we can leave it to google to fix all the content next ;)

The premise “browsers are as powerful as OSes” is dubious.

“Why do you need OSes” is something I would expect from someone who does not know how a computer works.

Whilst they should probably be tweaked, address bars are central to the web as it is currently.

Google should stay as far as possible from me and has no business telling me it approves of the sites I am browsing.

I did not downvote the post, but there is no sentence in it that does not make me regret having read it.

I understood the "Why do you need OSes" as "Why would you use Windows when you can use ChromeOS, since the only thing you'll ever need to open is Chrome"

And all of these opinions are obviously not held by the poster but are rather what the poster believes Google wants.

Now you know about web. Many (all?) people here (reading this shit) know. If you hear about what they are into, they are trying to get ''the next billion'' people into Their hands. Most of this ''next billion'' people don't have the time and/or courage to learn anything. They want to get their job done. (They will learn if they're forced to.)

What these big companies are trying to do is very clear. They don't want these fools to know much about web. If these people suddenly starts learning about how web works, that'd be a disaster (for Them).

Now, the address bar is just a distraction to them, nothing else. Now, if Google is removing them, let them. If the address bar is hidden, then there's less clutter. So, they'll think that it's better. (You and me know that isn't any better for us. I'd be really angry if they completely remove it.)

> Why are you referring to those big companies as 'Them'?

< You don't know yet?

google is not attacking the url bar, it's attacking dns, just like aol and verisign (and others) before it. google wants to replace the decentralized dns system with a centralized google lookup service, powered by their principle competitive advantage, search. google wants to control the internet itself.

they're banking on the idea that the average user wants to type (or speak) "macdonalds" and end up engaging with mcdonald's in some form. google wants to be the gatekeepers of the whole internet, not just the browser. the browser is small peanuts in comparison.

the simple narrative of this title/story is the kind of distraction we need to see right through with large organizations everywhere, whether it be a corporation, a government, or anything else. we the people must keep these entities in check so that they serve the greater good for all of us, not just the narrow and corrupt.

The Chromium blog post (which points out that like Safari on the Mac there's a setting now (not just a flag) to disable it):

https://blog.chromium.org/2020/08/helping-people-spot-spoofs...

"Always show full URLs" is such a breath of fresh air. It eliminates all the URL butchering (e.g. inconsistent hiding of http/https) that Chrome had been doing for more than a decade.

Though I'm not seeing the option by default on a fresh install of Chrome 86; hopefully that's just a rollout glitch.

What would be even more honest is that when people first install that version, they're asked what they want that setting to be.

It would be interesting to see the results.

Switched to Vivaldi.

One click, and Vivaldi shows the entire URL, as it should be, including scheme and everything.

(Vivaldi browser was founded by employees of Opera, when Opera was sold to a Chinese company. Vivaldi is owned entirely by it's employees)

Even today's protocol hiding is so inconvenient, who is making these decisions, do the use computers regularly?

The average user sees http://123.45.67.89/~sk/microsoft.com/techsupport as a legitimate Microsoft website. That's what this change is intended to fix: users that see a domain in any part of the URL as being valid. They want to change it to only show the part that's actually security relevant. If you tell the average user "Look for Microsoft in the URL", and they find it in the path, they're going to fall for a phishing scam.

HIDING the URL doesn't seem to be the most obvious solution to this, to me.

Protocol hiding was recently fixed, via the "Always show full URLs" option. The default is still an inconsistent mess, but checking this option makes the URL bar so much better than it's been in years.

There are a lot of comments about hiding the URL "because the user doesn't understand" -- has there been any research into user education directly in the address bar?

Like, fresh install page points @ google.com. Why not A little browser popup highlighting the parts of the URL and explaining it, with a link + tutorial on how to understand parts of the URL?

Rather than dumbing the interface down, why not inform users so they can use these platforms more effectively?

If you like chromium ecosystem, I suggest trying the Vivaldi browser. https://vivaldi.com

It won me over with (1) the ability to split the window into multiple tabs (2) ability to turn any webpage into a side-bar "applet-thingy" -- great for having whatsapp, todoist, always on the side while you switch tabs.

It also has plenty of other features aimed at power-users.

Can confirm. Vivaldi is absolutely fantastic for the reasons you named, plus its ability to use all common Chrome extensions such as uBlock Origin, uMatrix, Dark Reader, etc.

It's a problematic change, but is actually more usable. Now as a developer, I don't have to worry about changing the URL too much, in order to enable deep linking and the back button. I also don't have to worry about the unsightly but useful query parameters on a search page. This should become the new standard.

It's not like the mailboxes that the USPS is removing, ostensibly in response to declining mail volume. The mail boxes weren't in the way. They were built according to the city codes. Removing them before an election is all downside, and no upside.

The path and query params in the URL are in the way. If you're making a page that's a list of data that gets filtered, each time you change one of the filters, and call replaceState when it changes, it would change the URL bar. That's visual noise.

I used to be against this, because I'm against Google's overall agenda with the web. I thought about it and couldn't deny the usefulness of being consistent across mobile and desktop, and letting the URL change as frequently as is useful from the developer perspective.

> I don't have to worry about changing the URL too much, in order to enable deep linking and the back button. I also don't have to worry about the unsightly but useful query parameters on a search page. This should become the new standard.

I've been a web developer for both small and large companies for over 20 years and can assure you I have never worried about such things.

This is a false flag.

Currently I'm on https://news.ycombinator.com/reply?id=24161699&goto=item%3Fp...

Is that optimal?

Safari hides it on desktop now. Like I said I didn't want to admit it at first, but it's better.

It would certainly be noticeable on mobile if they word wrapped the entire URL so you could see it.

This has nothing to do with amp, and everything to do with users thinking http://printer001.cpalawyer.bz/mircosoftoneline.acutallogind... is a legit office 365 login page.

Not that they're going to notice that the url bar says something random anyways.

This article had a major thread two months ago: https://news.ycombinator.com/item?id=23516088.

It has been updated, apparently to mention an animation technique in the URL bar of Chrome 86, but that's apparently not SNI (https://hn.algolia.com/?query=%22significant%20new%20informa...) since the discussion here isn't mentioning it. So I think we have to call this on the dupe side. See also https://hn.algolia.com/?query=follow-up%20by%3Adang&dateRang... for how we moderate these.

I’ve wondered why we continue to display URLs as painfully-long single lines of text. Tradition? Why is this helpful anymore? (e.g. On an iPhone it’s not easy to edit the end of a URL.)

If it’s so damn hard to display full URLs on one line, let’s display them on several lines (at least after tapping on them), broken on dots to wrap. Spaces aren’t valid in URLs anyway.

I've thought about this as well. Tapping the URL bar on an iPhone should open a multi-line wrapping text block that doesn't require painful horizontal scrolling.

Broken on ...dots? Not slashes?

Mysite.

Com/Index.

Html

If URLs get hidden in such a way, developers are going to stop caring about them. This is going to result in experiences like we get with apps like Facebook, which doesn’t have any conceivable way to get back to certain content. Think single page apps that never have any URL changes.

Of course the brass at Google is incredibly short sighted and clumsy in their approach. All the good people at Google are gone and we’re left with the dredges and it’s starting to show.

Well it does make the host domain clearer which could making phishing attempts harder.

But it must be weird when navigating around a website, while the url remains static... ugh creepy

One of my favorite macOS/iOS features is URLs. Most good native apps-- Things, Drafts, DEVONThink, etc.-- support URLs. URLs such as `things://` and `drafts://`. Some accept POST as well as GET.

There's even a specification of an iOS/macOS protocol very reminiscent of webhooks. http://x-callback-url.com/

I wonder to what degree Google becoming increasingly a Walled Garden provides an opportunity for a new type of search engine. Instead of having to grapple with the breadth of services on the Internet, it grapples with the depth of each Walled Garden - Apple, Google, WeChat, etc.

I simply can't imagine that any one platform, however large, can truly grapple with the full range of use cases for the consumer internet.

If the domains were written from left to right / highest to lower level (example: com.ycombinator.news/... or com/ycombinator/news/...), this (particular) phishing problem would go away and there would be no reason to do this.

Out of ignorance, any proposals were made to change the order of (writing) domains levels? Or to create an alternative one (if that is even possible)?

This is how Safari for iOS (and desktop?) has worked for a long time... the domain is shown unless the URL field is selected. I like it.

Omg. I believe safari does that and I freaking hate it. I see how it makes every website act like an app, but these have real user values: you wouldn’t design a folder explorer by hiding where you are in the tree. Oh wait, actually that’s what macOS does already...

On the other hand, this is the default behavior on mobile browsers and it doesn’t seem to disturb anyone.

I often modify URLs when sharing with friends - stripping utm and other parameters especially when sharing amazon links

My search terms are not relevant to sharing a product ASIN

It seems that Google may view the web browser as an engine that is trying to reinvent native desktop apps. What’s old is new again just with some fancy words and a new generation

They should fix this bug first:

> Issue 1084406: Reappearance of "HTTPS://" causes URL text to move as you are selecting it

> https://bugs.chromium.org/p/chromium/issues/detail?id=108440...

The new "Always show full URLs" option fixes that, because http/https is always visible.

I prefer what Firefox. Just keep the domain name black/highlighted and the rest of URL gray.

But, for average user this might be more effective to detect phishing attacks since they never check full URL anyway. (Unless when a website does something stupid with query string parameters)

Feel like this is similar to a future self-driving Google car depositing me at my destination, but without telling me the address itself. We're here.

For me personally, this makes it official, I need to keep my guard up at all times when using anything Google.

I don't believe this is an attack. It hides the full address, but you can hover over it to see the whole thing, or even enable full addresses easily.

I believe this is legitimately done to improve UX for users who may be phished. Tying this to AMP is a mistake.

"Won't somebody please think of the children?!"

This is a really weak response. The post announcing the feature makes an extremely strong case for why this is a good thing.

The URL hiding thing is what finally pushed me to use Firefox full time last year.

I was just thinking about this the other day: at the same time, they keep adding weird, inscrutable nonsense at the end of every Google Search URL, so what's the point of hiding the protocols and www and whatnot?

Naaa. They are making up space for ads and chrome extensions. URLs are important, to the difference between a home page and other pages or will never know if you are redirected.

Hiding the full URL will redirect a lot of traffics back to Google's search engine because people can't easily figure out the source from a screenshot anymore.

If google can get enough people to stop using url's then they can start building a walled garden.

This is why I use and support Firefox. It's so sad to see Mozilla doing so badly right now when Google gets away with Evil.

This reminds me of that time when Microsoft started hiding file name extensions from the user, because reasons.

This is about censorship and control. Just type in what you want and we'll get what's best for you.

This seems like a problem that is easily solved by ceasing to use Chrome.

How does the URL bar look in Firefox these days?

Great news! Can’t wait to use, Ive been trying to hide the whole address bar altogether for so long

All of a sudden, I’m cheering for Microsoft’s decision to make Edgium available for Linux.

This is exactly why I forced myself to switch to FF quantum around 2 years ago.

Chrome is going downhill.

This is the same company that will selectively censor leaked information, as election interference.

https://techxplore.com/news/2020-08-facebook-google-election...

At this rate, China will be a more free country.

I'm not going to use a browser that lies to me about what web page I'm on.

Fuck. That means it ends my love affair with Chrome. I had such high hopes for us.

Mozilla move to cut so many people involved in an alt browser doesn't help

Couldn't be happier that I switched to firefox about a year ago.

My life is much better with Firefox. I don't miss Chrome at all.

What are they gaining from this that possesses then to fight such consistent opposition?

I don't see anyone stumping for this or any groups making any arguments for it beyond aesthetics, which is nice but surely doesn't outweigh all the vociferous opposition.

What gives? Cui bono?

I’m gonna go out on a limb here and say this might actually be a good thing for people who are looking for domains.

But also a great thing for google as they are going to reinforce searching instead of typing in a domain.

lol “attack,” your mobile browser already does this

Don't cry when anti-trust nukes come Google.

They're just BEGGING for an anti-trust suit.

I will from now on consider Chrome as a malware.

How do google engineers stand for this shit?

Apple has been doing it for a long time

First url shortner (goo.gl) now this;

Stop using Google products. They are evil. Switch to duckduckgo and Firefox or Brave and block all ads. Fuck these guys.

Please please stop this, Google.

Is this different than safari?

Having looked at the intended design implementation, I'm not _super_ against this change, but I'm not fully onboard. And the concept of AMP here isn't lost on me, either.

I understand the stated goal of this is for simplicity for users and enhancing generic security. I feel Firefox already does this better. Let's take the following URL for example:

https://code.visualstudio.com/docs/

On my work MBP with FF 79 and GC 81, this is what I see ([] signifies contrasted text color):

Firefox: https://code.[visualstudio.com]/docs/

Chrome: [code.visualstudio.com]/docs/

Chrome (after clicking twice in the address bar: https://[code.visualstudio.com]/docs/

Chrome 86 (uses above formatting on hover): code.visualstudio.com

In both apps, the dark themes provide more contrast that the light ones. I don't think we need to hide URL's from users, because what really matters is the very beginning of the URL which is always shown, and noting the root domain in a more contrasted, apparent way (like Firefox does) is to me a better solution to this problem. Spending time to improve the appearance of the important part of the URL will help everyone in the end, rather than taking the easy road of just isolating it.

Time would be better spent on solving horrible looking URLs in the first place and how URLs get represented in sharing (e.g. email clients, SMS, etc), which is where arguable most visual URL security concerns take place. If anything, I think I'm less likely to trust a URL like this (a simple Google search for "example url") when taking a glance in an email (removed https so full URL would show):

"://www.google.com/search?source=hp&ei=IJ82X6DoINCJytMP75Cn6As&q=example+url&oq=example+url&gs_lcp=CgZwc3ktYWIQAzICCAAyAggAMgIIADICCAAyAggAMgIIADICCAAyAggAMgIIADICCAA6CAgAELEDEIMBOgUIABCxAzoCCC46CwguELEDEMcBEKMCOgUILhCxAzoECAAQCjoLCC4QsQMQxwEQrwE6CggAELEDEEYQ-QFQkDJYxEdg3khoAnAAeAGAAbsBiAHBBpIBBDEyLjGYAQCgAQGqAQdnd3Mtd2l6&sclient=psy-ab&ved=0ahUKEwig-Nis85rrAhXQhHIEHW_ICb0Q4dUDCAg&uact=5"

than "://www.google.com/search?query=example+url"

If on mobile, go into landscape for the larger URL, unless there’s a better way to format it I’m not aware of. Didn’t think a code block was best for a massive oneliner.

A possible middle ground could be taking a look at limiting token visibility. But a larger discussion would be needed for that as well.

And that's why we need more competing browsers, not built from chromium source.

so... is this a chromium thing or a chrome thing? if it is just exclusive to chrome, then maybe it's time to finally give the new microsoft edge a try.

The official build of Chromium tracks Google Chrome quite closely, so I feel confident assuming that the change is there as well, even though I haven't checked. But since Chromium is open source, I'm not sure anyone can really answer that question. Whether the change is in Microsoft Edge depends on how far Microsoft is willing to diverge from mainline (and where specifically they want to spend their resources).

Don’t use it :)

we're getting there [0]

[0] https://xkcd.com/2105/

Really wish they would stop trying to do this.

It’s sort of surreal to feel so disenfranchised about it too. Like, no one wants this, I’m sure they know that, but they just don’t care.

They know that no matter what they do they're too big to be stopped. We cannot rely on on any of the five eyes governments to break their monopoly because their data collection programs are of immense value to these nations. If they ever are broken up, it'll be a 30 year smoke and mirrors campaign like when we 'broke up' Ma Bell [0]. Disenfranchised is right.

[0] https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2F...

Pushing Google one step closer to becoming Alphabet's AOL. Instagram and friends must be stealing quite some traffic and ad revenue.

Reply on news.ycombinator.com