top | item 24156986

Google resumes its attack on the URL bar, hides full addresses on Chrome 86

827 points| atriix | 5 years ago |androidpolice.com | reply

475 comments

order
[+] scott_s|5 years ago|reply
Something I haven't seen anyone here bring up yet: many URLs are meaningless to humans past the domain. For an example, look at the top of this page. The only semantic meaning in the URL for this post is `news.ycombinator.com`. The rest, `item?id=24156986`, is meaningless to a human. (But, of course, meaningful to HN's backend.) A lot of (most?) of the URLs on the web are not semantic. They're naked application look-ups. I claim that for this current page, there's no meaningful loss of information by just showing the domain.

But some URLs are semantic. I think losing those would lose useful information for human readers. If we could perfectly know which URLs have useful semantic information for users and which don't, and then only present those with full semantic meaning, I wouldn't mind much.

Main point: I see people saying things like "these designers think people are too stupid to understand URLS." But that ignores that some URLs are not actually meaningful to anyone.

Anticipated responses:

1. You are losing information by taking off the "application lookup" part: the information that an application lookup was made. Fair enough. But I claim it's a small loss.

2. We can never perfectly separate out the URLs with useful semantic information. Which, also probably true. But I think we can do a decent job, and as long as the full URL is present when I mouse-over it, I probably wouldn't object.

[+] worble|5 years ago|reply
>The rest, `item?id=24156986`, is meaningless to a human

Removing Url's is throwing the baby out with the bathwater though. Take Stack Overflow for an example:

https://stackoverflow.com/questions/53302536/vue-test-utils-...

The only thing you need to actually get to the question is https://stackoverflow.com/questions/53302536, but they intentionally add an extra human readable section for laypeople.

If google actually cared about making the internet a better place, they would simply rank human readable urls higher than non-human readable ones.

[+] wwweston|5 years ago|reply
> many URLs are meaningless to humans past the domain.

I'd argue this confuses meaningful with degrees of legibility. And also that it ignores how certain significant margins of users do learn this stuff.

`item?id=24156986` is immediately meaningful at least at one level: you know at some level you're looking at a specific item resource under the domain news.ycombinator.com. Processing which one requires a lot more attention and you're probably not going to build up a mental directory of corresponding numbers with discussions, and so that particular meaning passes beyond the threshold of legibility, but that doesn't mean the number itself is meaningless, anyone who's made a habit of paying attention to URLs knows what it is, just not that final layer of correspondence.

And it is not just web developers who know this stuff. I've seen laypeople who are just longtime browser users who have a pretty good idea how URLs like these work, not because anyone formally taught them how paths and query strings are spec'd, but just because the affordance of the URL bar is there and they've seen enough URLs correlated with browsing behavior to learn it by observance/association. The same way most people pick up language itself.

The URL bar teaches some people who care to notice how URLs work, which makes URLs work better as a social tech. And it doesn't require anyone who doesn't care to do so.

We lose that if we remove it. It's not a small loss.

[+] freedomben|5 years ago|reply
I don't agree at all that the URL is meaningless to humans. If I want my friend to read this page, I copy the link and send it to him. That ID above is clearly the comment page ID. I don't have to see the backend code to know that.

I'm certainly not an average user, but I am a human. The URL on nearly every site gives me all sorts of information.

[+] TeMPOraL|5 years ago|reply
As an example of semantic URLs, think of Wikipedia articles (ironically, featured in the article). The URL tells you directly what you're reading about. Why is it useful to show it in full? Because page titles are no longer visible during usual browsing sessions - they're shown in tab headers, which means in practice, you only get to see a favicon and maybe a word of the title if you're not a tab hoarder. So once you've scrolled halfway through a large article, the URL bar serves as the indicator of what you're actually reading.

The same applies to news sites, magazines, blogs, Reddit, social media sites - which is quite likely the majority of browsing done by normal people.

[+] Mathnerd314|5 years ago|reply
The 24156986 is semantic though; the ids are assigned sequentially to submissions. Early submissions have tiny ids like 495. So they are at least as meaningful as bug tracker ID's or version numbers.

Now, it is true that version numbers etc. could be more meaningful. Jeff Atwood wrote an old article about the "infinite version" in Chrome, where the version number basically doesn't matter until you're checking to see if you're up-to-date. Personally I've switched to using dates / times in my ID's. HN could do that too; an ID like 2020-08-14-10-12-13-99 is longer than the current ID's but not by much. But overall it seems hard to draw a line in the sand where dates are semantic and version numbers aren't.

[+] codingdave|5 years ago|reply
It isn't meaningless to all humans - we get screenshots sent in to our support team all the time, and even if the end user doesn't know what the URL means, the support team does. That quickly lets them recreate problems, find bad data, and give the devs enough information to reproduce bugs.
[+] feanaro|5 years ago|reply
> If we could perfectly know which URLs have useful semantic information for users and which don't, and then only present those with full semantic meaning, I wouldn't mind much.

That's a very large if, IMO. We cannot do this, practically speaking.

Even in semantically meaningless URLs like the one in your example, there is still an important part of semantics retained and that is identity. By having the URL available you can at least compare two URLs and judge whether they are the same URL or not. Additionally, there is a 1-to-1 association between URL and content: for each unique URL, you get some unique content.

I agree there might be some UX improvement possible here, but faced with the looming threat of Google AMP, it's not a time to twiddle our thumbs and idly fantasize about this without a complete and robust plan on how this improvement might be done.

I also think that by hiding the URL we will make ordinary users even more ignorant about how the web works. It will truly appear like magic, since they will see identical strings in the URL bar yet they will be served different content. How does this even work? No one knows! Expect users that won't even know how to copy a link to someone.

[+] Qub3d|5 years ago|reply
I like Firefox's current strategy of making the root domain brightly-colored and the rest of the url less-so.
[+] ArmandGrillet|5 years ago|reply
"many URLs are meaningless": many, but not important ones such as URLs from Reddit and GitHub.
[+] kobe_bryant|5 years ago|reply
this site is fine since these are submissions but its so satisfying when you can just edit parts of the url and go directly to the date and category you want
[+] gravitas|5 years ago|reply
> For an example, look at the top of this page. The only semantic meaning in the URL for this post is `news.ycombinator.com`. The rest, `item?id=24156986`, is meaningless to a human.

I agree, but I'm going to say the unpopular thing: HN has problems and is an archaic design from the past, and this issue is due to the proliferation of changing the titles of posts (thereby breaking a vanity URL) or changing the URL that the story points at to some other website. Using a vanity URL doesn't work for how the owners run this website and its my belief that it's in the minority along with forum (phpBB e.g.) websites and does not represent the larger percentage of the internet using vanity URLs with human readable text strings in them.

[+] cryptonector|5 years ago|reply
While many URLs are not designed for human consumption, many are, and many users are "trained" to some degree to understand them. But most importantly, users need some visual (or auditory, if sight-impaired) cue as to what kind of site their on, what domain at the very least. That's why HN puts the domainname of the authority of any posted links next to the title.

Regarding URLs that are not designed for human consumption, if they can possibly land in the status bar, then that's on their designers. Yes, of course, that's exactly what malicious players will do: design URLs that users can't parse -- but that's no reason to hide the bar altogether, but rather to hide parts of the URL (e.g., the scheme, the credentials, maybe the fragment, the query, even the path -- everything but the authority).

[+] arendtio|5 years ago|reply
But then again, you could argue, that URLs are meaningless to people. They are just some weird text and have neither face nor voice.

I am not sure what google tries to accomplish with those changes. Somehow it feels like some UX designer has made this his personal vendetta. Didn't they try it already some months ago and got pretty clear feedback?

If this is about phishing, who established the theory, that people who don't understand URLs, understand how phishing works and that even the slightest deviation in a domain is dangerous?

[+] notatoad|5 years ago|reply
not only are some URLs meaningless, they can in some cases be intentionally misleading. by hiding the non-domain portion of the URL, google is showing the only actual authoritative information contained in the URL: what site is hosting the page.
[+] berkes|5 years ago|reply
/r/webdev disagrees.
[+] avodonosov|5 years ago|reply
item?id=24156986 is readable and meaningful
[+] donor20|5 years ago|reply
Wow - top posts are conspiracy theories. "The only reason to do this..." "This is a security issue..."

Google has millions / billions of users. From a security standpoint the focus should be entirely on the root domain, that is the only really meaningful root of trust.

If you are talking about a security issue - the KEY security issue is ANY lack of clarity around root domain.

"Showing the full URL may detract from the parts of the URL that are more important to making a security decision on a webpage." is a statement they have around this change.

I think I agree - I suspect other browsers will have to copy chrome (again) in de-emphasizing the leading URL (often used for fishing).

Folks seem to miss the fact that google chrome was a minor competitor initially it IE - and their focus on things like ... security ... helped them become absolutely dominant. A fair number of enterprises have (finally) started slow slow switch to mandating chrome.

[+] badwolf|5 years ago|reply
My first thought when reading this was relief... For my mother.

I've spent most of my adult life trying to teach my parents to look at the address bar to make sure they're on bankofamerica.com and not some random phishing domain. That kind of falls apart though when it's... bankofamerica.comm.phishingdom.com/{random filler}/bankofamerica/user/login

HN users are fantastic at thinking all technologies should revolve around their niche use case.

[+] MaxBarraclough|5 years ago|reply
> their focus on things like ... security ... helped them become absolutely dominant

I don't think Chrome's security features had anything to do with its ascension. Chrome took off because it was fast and had a good UI (iirc it had the ability to drag a tab from one window to another, a while before other browsers did).

The average user knows nothing of the security features of their browser.

[+] mrmcd|5 years ago|reply
The degree to which HN is obsessed with AMP is hilarious at times. You'd think every single one of the 100k engineers that work there do nothing but dream up ways to trick people into using AMP for some secret illuminati end goal.

If you don't like AMP, that's fine. If you don't like this UX change that's fine too (and I suspect will be easily fixed with an extension). But maybe consider for a moment that not every single UX change to a product with a billion users is part of the vast AMPiracy.

[+] izacus|5 years ago|reply
The strange part there is that this is mobile Chrome following the mobile Safari UX which has never been criticised like this. It's just bizarre.
[+] unethical_ban|5 years ago|reply
They could emphasize the FQDN without removing the URL.
[+] coronadisaster|5 years ago|reply
> Folks seem to miss the fact that google chrome was a minor competitor initially it IE - and their focus on things like ... security ... helped them become absolutely dominant.

Security is a very small factor, if a factor at all, for Chrome to have become dominant. The main reason is because they keep/kept pushing everyone to install Chrome when you visited https://google.com (by showing you a small popup window).

[+] kevingadd|5 years ago|reply
Domains are only a meaningful root of trust if they're tightly controlled by a small set of people. A piece of content being on 'news.ycombinator.com' or 'github.com' literally tells me nothing about how trustworthy it is. In the case of yc, i have to look at the poster, and the actual content, and the replies to it. For github, I have to look at things like who posted the code and which repository it's in - both things that are displayed in the URL, oddly enough...

Google's URLs are of course long strings of useless hex/base64 garbage, so it's natural that they want to hide them.

[+] polote|5 years ago|reply
The title is misleading and people don't read the article.

Chrome is not hiding the bar address, it is only showing the domain in normal times, and showing the full url when you hover the bar

Personally I find it better for non technical people, because they can focus on the domain only. For tech people you have the option to keep the full url visible at all time, which fixes the issue.

As for people complaining about AMP, this is something different, which has nothing to do with displaying only the domain, but instead "showing the real domain when you are on a google AMP page"

[+] kats|5 years ago|reply
They're just trying to prevent phishing. Remember when the DNC was hacked?

Employees at the DNC were linked to sites that looked exactly like the Google sign-in page, except that the URL was "myaccount.google.com-securitysettingpage.tk".

picture of the phishing website:

https://security.stackexchange.com/questions/189688/does-goo...

From interviews, it seems like there's two features Chrome developers are working on try to prevent these kinds of attacks. One is to hide the subdomain so that people can't make such tricky looking URLs. Another is feature to identify lookalike URLs and let users know about the anomaly.

sources:

https://www.nytimes.com/interactive/2017/01/06/us/russian-ha...

https://p3isys.com/p3isys-tech-blog/153-podestahack

https://www.wired.com/story/google-chrome-kill-url-first-ste...

[+] AnonHP|5 years ago|reply
I get emails from some banks with instructions to spot phishing. One of those is to look at the full URL in emails or on websites to know if it’s authentic or not.

For better or worse, the URL scheme is what we have to identify websites and pages. Hiding that on larger screens doesn’t make much sense. It also hinders learning for the next generation.

[+] crazygringo|5 years ago|reply
Remember folks, Apple has been doing this in Safari since 2014. And there's been zero uproar over it at all. I don't understand why people suddenly hate this just because it's Google.

For most users, total focus on the domain name is a security feature. For 99% of users, what comes after the domain name might as well be gibberish. I mean, it is a majority of the time.

[+] dessant|5 years ago|reply
When the final version is implemented in a couple of years you will no longer see any URL, that way it won't be as evident that most sites on the web will be loaded from Google.

Google is also attacking this issue from a different perspective with Signed Exchanges [1][2], to fake the URL and ensure their success in becoming the gatekeepers of the internet.

If you refuse to become a content provider for Google's vision of the web, then they currently won't feature you at the top of search results in the Top Stories carousel, and perhaps demote you entirely from the first page in the future, depending on how their hijacking strategy works out.

[1] https://news.ycombinator.com/item?id=19678693

[2] https://www.iab.org/wp-content/IAB-uploads/2019/06/mozilla.p...

[+] davidmurdoch|5 years ago|reply
Jake Archibald (a Googler) presents some decent points on this on the HTTP 203 podcast: https://youtu.be/0-wB1VY3Nrc

I still don't agree with the removal of URLs, but I do still recommend watching the entire video if you want to get more perspective on the issue (beyond just the conspiracy theories about AMP and control).

[+] bambax|5 years ago|reply
For now I'm quite happy to have finally switched to Firefox a few months ago.

If Firefox disappeared though, as it seems it might, that would be horribly frustrating.

[+] simonkafan|5 years ago|reply
I still haven't found a good answer why they do this. "Makes it harder to tell if the current site is legitimate" sounds like an excuse. If you are the perfect target for a phishing attack (= clicks on everything, enters passwords everywhere, has no clue about host names) then you also won't be able to understand what Chrome presents you in the address bar after obfuscation.

My best explanation so far is that the Chrome team doesn't know how to improve their browser anymore so they just make up work to keep the software engineers busy.

[+] tyingq|5 years ago|reply
Trying hard not to sound like a conspiracy theorist. However, it's pretty obvious this benefits a walled garden strategy. With things like AMP, "rich snippets", etc, they keep eyeballs on Google owned properties longer. Slowly deprecating urls over time makes it less visually apparent.

AOL was able to sell "keywords" this way, because it wasn't always obvious to their users how to get to the real internet.

[+] SifJar|5 years ago|reply
I think the justification is that some people will think the website is legitimate if a legit hostname appears anywhere in the URL e.g.

http://scamsite.com/microsoft.com/phish

"looks" legit because it contains the string "microsoft.com" (and most "regular" users won't appreciate the different parts of a URL); under the new scheme, that would display only as "scamsite.com" and hopefully people are less likely to enter their microsoft username/password if "microsoft.com" doesn't appear anywhere in the address bar.

I'm not overly convinced of this personally, but I think that's the supposed idea behind it.

[+] texasbigdata|5 years ago|reply
From an advertising perspective if the cost to serve amp is less than ad revenue, this makes perfect sense. Every click on google goes to google, and you’ll like it too bc you won’t have a choice.
[+] untog|5 years ago|reply
> “Makes it harder to tell if the current site is legitimate" sounds like an excuse.

Why? To me, having helped elderly relatives with computers a lot, it is very plausible. Phishing URLs use all sorts of subdomain and querystring tricks to fool users, and it can work.

[+] neop1x|5 years ago|reply
As someone noted, not only that. But you won't see on which subreddit you are at for example. That's quite annoying.
[+] khaledh|5 years ago|reply
IMO this is the real reason why they're pushing hard towards this:

  However, it's also worth considering that making the web address less important, as this feature does, benefits Google as a company. Google's goal with Accelerated Mobile Pages (AMP) and similar technologies is to keep users on Google-hosted content as much as possible, and Chrome for Android already modifies the address bar on AMP pages to hide that the pages are hosted by Google.
[+] cdmckay|5 years ago|reply
Hasn’t Safari already been doing this for ages with no issues?
[+] TedDoesntTalk|5 years ago|reply
> “Showing the full URL may detract from the parts of the URL that are more important to making a security decision on a webpage," Chromium software engineer Livvie Lin said in a design document earlier this year.

I’m a software engineer, too, but I would never make such an important UX decision because I know that is not my area of expertise.

I hope they’ve gotten significant user feedback on this before rolling it out.

Personally, I hate it.

[+] Santosh83|5 years ago|reply
Vote with your choices (use a different browser). That's the only way to address such behaviour. Yes, I know the 95% out there who don't even know what a browser is but only know Chrome's icon gives access to the web won't understand any of this and they will continue giving mega-corporations a critical mass of unquestioning users to be used, but we have no other options.

We either express our voices, no matter if they're fringe (and hope it catches on) or we can just give up and not even write these articles any more.

[+] throwaway6288|5 years ago|reply
This is why we should jump over to Firefox. Today! And by us I mean we who know that this is a bad idea. Mozilla is suffering and this is our last chance to not let Google and chrome have total dominance over the web. Mozilla copies Chrome a lot, but they need more market share to be able to get a say here and take the point of us power users.

I have been using and contributed to Firefox for years, and it is a great browser!

Come on, we know better! Use Firefox or watch Google destroy the open web. It's up to us!

Mozilla has flaws, yes, but this is important! That technical users continue to use Chrome is beyond me.

[+] amiga-workbench|5 years ago|reply
A nice side effect for them is that it makes it less obvious you are viewing an AMP site.
[+] rchaud|5 years ago|reply
URLs are supposed to be human-readable because they're intended to signal to users what the content is about.

What is not human-readable, although fully semantic, is all the parameter trash that comes after full URL. Stuff like "utm_source='twitter'&utm_medium='social_share" or cookie information and the like.

I can understand trimming that information, but hiding the URL to show the domain only makes no sense.

[+] pkamb|5 years ago|reply
The example url in the article is:

> https://en.wikipedia.org/wiki/URL#Internationalized_URL

which is shortened in the address bar to:

> en.wikipedia.org

at the VERY least, I wish they would instead use:

> en.wikipedia.org/wiki/URL

Same for Twitter and Reddit URLs, specifically. Don't hide the username or the subreddit.

[+] smlckz|5 years ago|reply
Sigh. Now browsers are as powerful as OSes. Why do you need OSes?

Address bars? People don't need them. Google should tell you which website you're visiting is good or which is bad if they hide the address bar.

[+] asimpletune|5 years ago|reply
I’m not sure why this is being downvoted, this is an accurate albeit sardonic description of what’s happening.

People don’t want to visit AMP sites, they want to visit the site that’s the original source for their news, etc...