Hacker News Reader

Comment by iamthepieman | Hacker News Reader

This is pretty funny and well done - but doesn't a real short url just redirect to the original so you end up with the full url in your browser bar?

Of course we all know how much attention most people pay to what their browser is telling them.

View on HN

Well, and given recent UI changes to the address bar from both Apple [0] and Google [1] - I'd say that people will begin paying even less attention to URLs.

Trolls rejoice.

[0] http://appleinsider.com/articles/14/06/04/os-x-yosemite-firs...

[1] http://www.zdnet.com/google-experimenting-with-hiding-urls-i...

Google is hiding PATH not DOMAIN_NAME, which makes this phishing activity EASIER to detect. That's the point of the feature!

Except it isn't phishing.

That's debatable. I think the only difference is maybe the intent of the attacker?

As I understand it, phishing is when you obtain sensitive information from a user while impersonating a site the user trusts. I don't suppose there's any exchange of sensitive information taking place here (nor is it possible if I am not mistaken, unless the website creator has any bad intent).

Removing http:// from the url was bad enough. Now they are going to only show the domain? I'm so glad I don't use chrome anymore. It's this kind of obnoxious "we know better than you and won't let you configure otherwise" bullshit that made me hate it.

Even if it was customizable, the defaults is something most people don't change.

Case and point: IE Toolbars. People hate them but never remove them. Ever. Even as those toolbars are making their browser take minutes to load any page.

That used to be true, but these days IE is pretty aggressive about disabling things, and telling you when they're slowing you down. Doesn't help everyone but seems to help some.

The chrome setting is behind a config flag.

Those changes should make this kind of thing more obvious, not less, unless you can figure out a way to host the altered version on github.com.

Using github.io? As the URL bar loses importance then people will just tend to ignore it, and on first glance (and probably for anyone who's not familiar with github pages) they will both look as valid.

You can't use github.io, only [project-name].github.io. Sure they could use a fake-but-similar project name, but then again, they already could with github.com/[project-name]. I don't see the big difference for the user.

Did you mean http://shrturl.co/EPUi5 ?

Why don't they just bold the domain? Chrome sort of grays the rest of the URL, but the difference isn't stark enough.

Couldn't you change the browser display of the url without reloading the page such that you can mimic the url as well.

There's no way any browser would allow that and no reason for it. It would make phishing orders of magnitude more effective.

Reply on news.ycombinator.com