IN SEPTEMBER, MEMBERS of Google’s Chrome security team put forth a radical proposal: Kill off URLs as we know them. The researchers aren’t actually advocating a change to the web’s underlying infrastructure. They do, though, want to rework how browsers convey what website you’re looking at, so that you don’t have to contend with increasingly long and unintelligible URLs—and the fraud that has sprung up around them. In a talk at the Bay Area Enigma security conference on Tuesday, Chrome usable security lead Emily Stark is wading into the controversy, detailing Google’s first steps toward more robust website identity.
Stark emphasizes that Google isn’t trying to induce chaos by eliminating URLs. Rather, it wants to make it harder for hackers to capitalize on user confusion about the identity of a website. Currently, the endless haze of complicated URLs gives attackers cover for effective scams. They can create a malicious link that seems to lead to a legitimate site, but actually automatically redirects victims to a phishing page. Or they can design malicious pages with URLs that look similar to real ones, hoping victims won’t notice that they’re on G00gle rather than Google. With so many URL shenanigans to combat, the Chrome team is already at work on two projects aimed at bringing users some clarity.
“What we’re really talking about is changing the way site identity is presented,” Stark told WIRED. “People should know easily what site they’re on, and they shouldn’t be confused into thinking they’re on another site. It shouldn’t take advanced knowledge of how the internet works to figure that out.”