Hacker News Reader

Comment by readingnews | Hacker News Reader

I agree with this. The UI is moving more and more towards not showing URLs, emails, addresses, and other things that might clue a non-savvy user into being duped. But who do we complain to? They (FAANG, etc) are doing this to increase usage and profits, right?

View on HN

The URL move is more nuanced than that, no? If you look at how modern browsers decide what to show you in the address bar, they often try to show you the hard-to-fake bit instead of the whole url, so you see notreallygoogle.com instead of google.com.search.q.notreallygoogle.com or notreallygoogle.com/http://google.com and similarly you’ll see the punycode if the browser thinks the domain name may be trying to look like another one with confusables.

I agree the email situation isn’t great but it is also more complicated: lots of legitimate companies send emails via third parties or otherwise want to put a name quite different from the email (e.g. mail chimp but also google docs comments appear to come from the commenter rather than some big id email address), so it isn‘t as simple as showing the full address only and users may learn to ignore the full address if it is fully of random-looking letters/digits. And email protocols complicate it further because there are ways in which the from field may not even match the actual sender, though that isn’t such a problem with gmail. I definitely do hope things will improve, however.

Domain names are just fundamentally displayed wrong - the left to right reading order doesn't prioritise the right information.

"com.google" is what you need to see since it tells you who's really in charge of the content.

Particularly on mobile where I'm writing this I currently can see at most "news.ycombinator.co..." in the address bar. Could be a lot after that, how would I know at a glance?

Google and Mozilla could make substantial progress on this today by just showing an extra bit with the start of a domain name in right-to-left reading order.

Edge seems to be doing things right in that department. On my phone I see the whole URL and the lock indicating https.

Same on Safari.

If I add more subdomains, it still displays the label and the extension in priority, the additional subdomains are faded and hidden on the left.

This seems sane to me.

Some time ago, I read an interview with Tim Berners-Lee (I can't find the interview anymore, though) in which he said that if he could go back in time, he would reverse the URLs, starting from the top-level domain. Just like newsgroup hierarchies.

I think this is how they worked in the olden days. But maybe I’m confusing domain names with some uucp thing. I think the names were reversed for email (maybe a false story though) so an email address would go from least significant part to most significant part, but this was pretty broken for urls as you had middle-significance to most then middle to least.

This is a good point. It's become typical for companies to use different email sending domains.

What we really should be doing is automating what I do when I get an email from a new domain that might be legit. Look up the DNS info so I can confirm it's the company they say they are.

To me, Gmail these days feels more and more like it's been designed by somebody who don't actually use email.

In this case, the top priority should be display name, (verified) source address and time of reception. The To and BCC line is not that important, thus can be folded under description such as "To you and another...".

I hear that product design in Google is data driven, I'm not really sure what UX data Gmail team has been consuming.

> The To and BCC line is not that important

bcc in inbound mails?

Especially in email, the clear name is rather a comment. Showing just the comment instead of the real data is negligent, at best.

(It's actually quite the opposite of what is going on with URLs, where everything is suppressed but the core domain name. Here, the originating domain and user is suppressed. It's more like showing the document title in the location field.)

The preference for real names in email clients is actually quite annoying. E.g., some of my clients are using institutional email addresses, which are used and processed by multiple real-person users with associated clear names. Every time, I mail to one of these addresses (not addressing anyone in particular, but rather to whom these may concern, which is the expressed purpose of these addresses), I've to go back to the address and to discard the auto-filled, nonsensical clear name (which may be the person using that address, I received mail from last). In some email clients, this may involve multiple steps, as they really want to show a clear name and a clear name only.

This reminds me of the baffling decision when Windows started hiding file extensions by default.

What year was that?

I believe it changed with Windows XP, so 2001.

(Oh my, has it really been that long?)

It was earlier, ME or 90 SE.

You're right! My mistake.

Windows 95.

Out of interest, do they still do that?

Yes.

Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo?

I think the whole principle of "anyone who knows your email address / phone number can contact you" was already obsolete over 20 years ago. Access to my inbox and ringer should be by revocable invitation only.

I hate how hard Slack makes it to copy a damn username. I get messages from people and try to look them up in the corporate directory but at some point it is just easier to type it in.

I don't know if there's an equivalent on other OSs, but in most browsers in Windows if you hold down Alt you can select text in an otherwise clickable link.

Ctrl-click on a mac at least gives the option.

But this is what I hate most about Slack specifically and Electron in general. It’s so obviously a web app shoved into what kinda looks like a native window. But all the behavior is webpagey, except not in my browser, which I already know how to use.

Here’s a fun one:

Click in the conversation history panel. Use your “select all” shortcut. Despair.

Why not just use the webpage? I've only ever used Slack (and Mattermost, which my work uses) in my browser, and I'm not sure what reasons there could be to install the app when it's just a less convenient container for the same content.

I actually want a native app. Going to the web would be another step backwards.

Verifying that it works in Firefox in Linux (with Gnome and with Sway, in case that matters). Thanks a lot for this!

I really doubt the basis of this argument. Arguably, there is something to be learned with any new technology and any expectation to the contrary may be rather illusionary. E.g., with the postal system, how do you know that Paris, Texas, is not Paris, France, when you ignore those "technical" bits like "Texas" and "France"? (But, when these were mentioned in conversation, you could infer this from context, but now, on the letter envelope, there's no such context provided at all!) Turns out, most people were able to cope with these "technical" challenges and some aspects of this were even taught in school (how to write an address). Most people are even able to memorize the ZIP codes most important to them.

Arguably, email addresses are (much) simpler to parse than postal addresses (including thing's like c/o, post boxes, etc.)

> Arguably, email addresses are (much) simpler to parse than postal addresses (including thing's like c/o, post boxes, etc.)

Both are equally easy to fake. The difference is sending fake bulk postal mail is much more expensive than email.

There's a difference between that and correctly guessing that a specific address belongs to a scammer. Also fake letters from the IRS etc. are a thing and people still fall for it.

Detecting scams like this is a skill and some people - like elderly or disabled people - just aren't good at it. It doesn't help that some legit businesses are officially using gmail/hotmail/whatever addresses.

I'd say, 99.x% of the scam or fishing attempts I receive are easily detectable by the email address. E.g., a fairly accurate rendition of the bank CI, even with an appropriate text, an email clear name in accordance with the bank, but something like "<_petra167fghj@unknownserver.com>" as the email address. The problem being, it's exactly that part, which gives the scam away, that is hidden by the common email client.

> Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo?

Email campaigns from companies are a mess. Even the company I work for sends official emails out from addresses at numerous 3rd party domains each using different mail servers. They often go out with verbiage nearly identical to what I see in phishing emails. They've contained links that point to URL shorteners or some other random 3rd party site that we don't own with URLs full of unintelligible tracking info.

I deal with phishing issues almost every day. Most of the time phishing emails are pretty obvious, but I've had customers ask me if an email claiming to come from the company I work for was legitimate and even after looking over the message and the headers I couldn't give a clear answer. I've had several talks with marketing about it, and I've managed to catch a few horrific communications before they went out, but they aren't willing to stop sending from or linking to third parties.

Even first party domains can be a problem if…uh…certain departments get a hold of the email address. I’ve definitely been I meetings that go something like:

Developer: Does anyone know why helpdesk@company.com is being flagged as a spam address? All of our customers are saying our support emails are ending up in their spam folder.

Marketing guy: Yeah does anyone know why our support and advertising emails are being marked as spam?

Developer: …never mind.

The documentation for Mailgun specifically asks you to send transactional and marketing e-mails from separate subdomains for precisely this reason.

It still doesn't justify companymarketing.com and companyhelpdesk.com though.

Was that the old principal? The one I've always ascribed to was "if you didn't initiate the communication then don't respond to it"

Maybe, maybe not, but they still have a much better thane than when it comes from "Venmo Support".

> Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo?

In many cases, no. They simply see that it has Venmo (or whatever) in it and assume it must be legit.

I've tried to explain this exact thing a few times. Not even sure I managed to get them to understand that a big company wouldn't use Gmail, but rather their own domain.

If they know what Venmo's real address is, because presumably they would've already seen the real emails many times, then the sudden change of address could be noticed and arouse some suspicion. As it is, without that hint, they are even less likely to notice.

> They (FAANG, etc) are doing this to increase usage and profits, right?

Yes. They're obfuscating the mechanisms that can be used to assess trustworthiness so they can sell it back to us as some kind of reputation or verification product.

Email is a perfect example. If the from address wasn't moved around, hidden, and obfuscated, it would be easy to tell people "make sure Venmo emails are from @venmo.com" and that's the thing everyone would look for. Instead, there's an entire generation of people that don't know how to identify a from address and it opens the door to a paid verification platform instead.

> But who do we complain to?

I mean, you don't. You stop using their company, and you let them and everyone else know why. Vote with your dollars or with your feet.

Reply on news.ycombinator.com