Google resumes its attack on the URL bar, hides full addresses on Chrome 86 (opens in new tab)

We are going back to AOL days. That didn’t work out so well for AOL in the long run. It’s kind of crazy to me you can’t do marketing now without at least discussing Google and Facebook these days.

Edit: at least you knew you were the customer with AOL and paid them with clear terms for access.

I encourage everyone to use Firefox on Android just for the one killer feature of being able to install the full desktop ublock origin plugin.

I don't think this is true at all. If anything, this change actually hurts AMP because now none of the original host url is visible at first.

I don't like browsers that do this, its the first thing I turn off in Safari, but how does Apple manage to get away hiding the full path under positive intent, but when Google does it its because they're evil?

I think it's pretty fair to say that the wider population of users aren't very good at determining which part of the URL is the authority, so any change to help with that can only be positive imho.

To play the devil's advocate, Apple's Safari has been hiding full addresses for quite a while, without having any direct benefit as a company as far as I know.

It need not be malice. It maybe because the design people think people are too stupid to understand URLs.

As other comment mentioned, Safari does it too.

The trend seems to be abstracting away stuff like filesystem. Many people I know don't even organize stuff into folders on their phones. Everyone seems to dump everything in Download or something like that. The existence of separate applications for Music, Video and Photo content makes it irrelevant to some extent.

If that conspiracy theory is true, what reason does Apple have to do this exact same thing on iOS Safari?

Specifically how does this change benefit Google?

The security problems that it addresses are very concrete and specific. I can clearly see how this change helps novice users.

How does this change benefit Google? It seems very hand-wavy.

Edit: downvotes, but no explanation of any specific benefit to Google from this change

Seems unlikely, considering they're also pushing for signed exchange (SGX) which also does the same thing.

Reason number 368 why I've moved everything to Safari + DuckDuckGo. I still can't believe they won the suit with Genius and being caught poaching their content for their own representation

>AMP

Tangentially related: on mobile, I've been having a good time with Firefox with this plugin: https://addons.mozilla.org/en-US/firefox/addon/amp2html/

A good anti-trust investigation and subsequent break up of the company should fix this problem.

> Chrome for Android already modifies the address bar on AMP pages

How does it do this? The URL looks totally as I'd expect (google.com/amp/) - I'm on version 84.0

You can also use an ad blocking DNS, it's been working great for me

Yep. The Internet is now "The Google."

agreed 100%

Google revenue is slowly going down

Only option for Google is to pretend Internet doesn't exist

Anyone who is using Adwords or doing Search Engine Optimization

look at what results look like

It's 50% to 70% traffic being routed to Google

remaining being routed mostly to people who pay a lot to Adwords

*

It's almost purely Pay to Play now in most of the lucrative areas

>The rest, `item?id=24156986`, is meaningless to a human

Removing Url's is throwing the baby out with the bathwater though. Take Stack Overflow for an example:

https://stackoverflow.com/questions/53302536/vue-test-utils-...

The only thing you need to actually get to the question is https://stackoverflow.com/questions/53302536, but they intentionally add an extra human readable section for laypeople.

If google actually cared about making the internet a better place, they would simply rank human readable urls higher than non-human readable ones.

> many URLs are meaningless to humans past the domain.

I'd argue this confuses meaningful with degrees of legibility. And also that it ignores how certain significant margins of users do learn this stuff.

`item?id=24156986` is immediately meaningful at least at one level: you know at some level you're looking at a specific item resource under the domain news.ycombinator.com. Processing which one requires a lot more attention and you're probably not going to build up a mental directory of corresponding numbers with discussions, and so that particular meaning passes beyond the threshold of legibility, but that doesn't mean the number itself is meaningless, anyone who's made a habit of paying attention to URLs knows what it is, just not that final layer of correspondence.

And it is not just web developers who know this stuff. I've seen laypeople who are just longtime browser users who have a pretty good idea how URLs like these work, not because anyone formally taught them how paths and query strings are spec'd, but just because the affordance of the URL bar is there and they've seen enough URLs correlated with browsing behavior to learn it by observance/association. The same way most people pick up language itself.

The URL bar teaches some people who care to notice how URLs work, which makes URLs work better as a social tech. And it doesn't require anyone who doesn't care to do so.

We lose that if we remove it. It's not a small loss.

I don't agree at all that the URL is meaningless to humans. If I want my friend to read this page, I copy the link and send it to him. That ID above is clearly the comment page ID. I don't have to see the backend code to know that.

I'm certainly not an average user, but I am a human. The URL on nearly every site gives me all sorts of information.

As an example of semantic URLs, think of Wikipedia articles (ironically, featured in the article). The URL tells you directly what you're reading about. Why is it useful to show it in full? Because page titles are no longer visible during usual browsing sessions - they're shown in tab headers, which means in practice, you only get to see a favicon and maybe a word of the title if you're not a tab hoarder. So once you've scrolled halfway through a large article, the URL bar serves as the indicator of what you're actually reading.

The same applies to news sites, magazines, blogs, Reddit, social media sites - which is quite likely the majority of browsing done by normal people.

The 24156986 is semantic though; the ids are assigned sequentially to submissions. Early submissions have tiny ids like 495. So they are at least as meaningful as bug tracker ID's or version numbers.

Now, it is true that version numbers etc. could be more meaningful. Jeff Atwood wrote an old article about the "infinite version" in Chrome, where the version number basically doesn't matter until you're checking to see if you're up-to-date. Personally I've switched to using dates / times in my ID's. HN could do that too; an ID like 2020-08-14-10-12-13-99 is longer than the current ID's but not by much. But overall it seems hard to draw a line in the sand where dates are semantic and version numbers aren't.

It isn't meaningless to all humans - we get screenshots sent in to our support team all the time, and even if the end user doesn't know what the URL means, the support team does. That quickly lets them recreate problems, find bad data, and give the devs enough information to reproduce bugs.

> If we could perfectly know which URLs have useful semantic information for users and which don't, and then only present those with full semantic meaning, I wouldn't mind much.

That's a very large if, IMO. We cannot do this, practically speaking.

Even in semantically meaningless URLs like the one in your example, there is still an important part of semantics retained and that is identity. By having the URL available you can at least compare two URLs and judge whether they are the same URL or not. Additionally, there is a 1-to-1 association between URL and content: for each unique URL, you get some unique content.

I agree there might be some UX improvement possible here, but faced with the looming threat of Google AMP, it's not a time to twiddle our thumbs and idly fantasize about this without a complete and robust plan on how this improvement might be done.

I also think that by hiding the URL we will make ordinary users even more ignorant about how the web works. It will truly appear like magic, since they will see identical strings in the URL bar yet they will be served different content. How does this even work? No one knows! Expect users that won't even know how to copy a link to someone.

I like Firefox's current strategy of making the root domain brightly-colored and the rest of the url less-so.

"many URLs are meaningless": many, but not important ones such as URLs from Reddit and GitHub.

this site is fine since these are submissions but its so satisfying when you can just edit parts of the url and go directly to the date and category you want

> For an example, look at the top of this page. The only semantic meaning in the URL for this post is `news.ycombinator.com`. The rest, `item?id=24156986`, is meaningless to a human.

I agree, but I'm going to say the unpopular thing: HN has problems and is an archaic design from the past, and this issue is due to the proliferation of changing the titles of posts (thereby breaking a vanity URL) or changing the URL that the story points at to some other website. Using a vanity URL doesn't work for how the owners run this website and its my belief that it's in the minority along with forum (phpBB e.g.) websites and does not represent the larger percentage of the internet using vanity URLs with human readable text strings in them.

While many URLs are not designed for human consumption, many are, and many users are "trained" to some degree to understand them. But most importantly, users need some visual (or auditory, if sight-impaired) cue as to what kind of site their on, what domain at the very least. That's why HN puts the domainname of the authority of any posted links next to the title.

Regarding URLs that are not designed for human consumption, if they can possibly land in the status bar, then that's on their designers. Yes, of course, that's exactly what malicious players will do: design URLs that users can't parse -- but that's no reason to hide the bar altogether, but rather to hide parts of the URL (e.g., the scheme, the credentials, maybe the fragment, the query, even the path -- everything but the authority).

But then again, you could argue, that URLs are meaningless to people. They are just some weird text and have neither face nor voice.

I am not sure what google tries to accomplish with those changes. Somehow it feels like some UX designer has made this his personal vendetta. Didn't they try it already some months ago and got pretty clear feedback?

If this is about phishing, who established the theory, that people who don't understand URLs, understand how phishing works and that even the slightest deviation in a domain is dangerous?

not only are some URLs meaningless, they can in some cases be intentionally misleading. by hiding the non-domain portion of the URL, google is showing the only actual authoritative information contained in the URL: what site is hosting the page.

/r/webdev disagrees.

item?id=24156986 is readable and meaningful

My first thought when reading this was relief... For my mother.

I've spent most of my adult life trying to teach my parents to look at the address bar to make sure they're on bankofamerica.com and not some random phishing domain. That kind of falls apart though when it's... bankofamerica.comm.phishingdom.com/{random filler}/bankofamerica/user/login

HN users are fantastic at thinking all technologies should revolve around their niche use case.

> their focus on things like ... security ... helped them become absolutely dominant

I don't think Chrome's security features had anything to do with its ascension. Chrome took off because it was fast and had a good UI (iirc it had the ability to drag a tab from one window to another, a while before other browsers did).

The average user knows nothing of the security features of their browser.

The degree to which HN is obsessed with AMP is hilarious at times. You'd think every single one of the 100k engineers that work there do nothing but dream up ways to trick people into using AMP for some secret illuminati end goal.

If you don't like AMP, that's fine. If you don't like this UX change that's fine too (and I suspect will be easily fixed with an extension). But maybe consider for a moment that not every single UX change to a product with a billion users is part of the vast AMPiracy.

The strange part there is that this is mobile Chrome following the mobile Safari UX which has never been criticised like this. It's just bizarre.

They could emphasize the FQDN without removing the URL.

> Folks seem to miss the fact that google chrome was a minor competitor initially it IE - and their focus on things like ... security ... helped them become absolutely dominant.

Security is a very small factor, if a factor at all, for Chrome to have become dominant. The main reason is because they keep/kept pushing everyone to install Chrome when you visited https://google.com (by showing you a small popup window).

Domains are only a meaningful root of trust if they're tightly controlled by a small set of people. A piece of content being on 'news.ycombinator.com' or 'github.com' literally tells me nothing about how trustworthy it is. In the case of yc, i have to look at the poster, and the actual content, and the replies to it. For github, I have to look at things like who posted the code and which repository it's in - both things that are displayed in the URL, oddly enough...

Google's URLs are of course long strings of useless hex/base64 garbage, so it's natural that they want to hide them.

Google has not only become dominant because their product is good. First and foremost, they leveraged their market power through android and their search engine to get people to use chrome.

They could just color it differently or show it in bold text.

Hiding the rest is clearly motivated by something else.

at what point is not any longer? Once the URL bar has gone?!

"Conspiracy theory!" has become a term for dismissing genuine concerns.

Actually, that's their argument for doing it. Most users don't understand the different bits of a URL, to know whether it's from the site they think it's from. See (huge) previous discussion from two months ago: https://news.ycombinator.com/item?id=23516088

Personally, for my own purposes, I think hiding any bit of the URL is incredibly inconvenient. Already hiding the www. is seriously annoying. I will switch this new behaviour off and hope they don't remove that option.

Embarrassingly I let checking the URL bar give me a false sense of security and got phished for the first time just a few days ago. They put a fake URL bar into the page and made it look like a proper OAuth2 URL. (My 2nd factor saved me from giving them access since it slowed me down enough to notice some subtle oddities, but I still had to change the password since that was already submitted)

The real protection against this is making it impossible for me to send credentials to the wrong party. Normally my password manager helps with that, but I had just switched managers a couple days before and it wasn't recognizing all sites properly (likely due to the lack of a database of known equivalent URLs). If the site was using WebAuthn, there wouldn't have been any issue because the imperfect URL checks by me and the password manager would not be necessary.

The bank may say that, but it's not actually good or practical advice.

Countdown until scammers figure out a way to screw up the parsing code and get Chrome to show the incorrect fake url

This has been the standard on safari for years. Are you saying that people who use safari suffer from those problems?

Trying hard not to sound like a conspiracy theorist. However, it's pretty obvious this benefits a walled garden strategy. With things like AMP, "rich snippets", etc, they keep eyeballs on Google owned properties longer. Slowly deprecating urls over time makes it less visually apparent.

AOL was able to sell "keywords" this way, because it wasn't always obvious to their users how to get to the real internet.

I think the justification is that some people will think the website is legitimate if a legit hostname appears anywhere in the URL e.g.

http://scamsite.com/microsoft.com/phish

"looks" legit because it contains the string "microsoft.com" (and most "regular" users won't appreciate the different parts of a URL); under the new scheme, that would display only as "scamsite.com" and hopefully people are less likely to enter their microsoft username/password if "microsoft.com" doesn't appear anywhere in the address bar.

I'm not overly convinced of this personally, but I think that's the supposed idea behind it.

From an advertising perspective if the cost to serve amp is less than ad revenue, this makes perfect sense. Every click on google goes to google, and you’ll like it too bc you won’t have a choice.

> “Makes it harder to tell if the current site is legitimate" sounds like an excuse.

Why? To me, having helped elderly relatives with computers a lot, it is very plausible. Phishing URLs use all sorts of subdomain and querystring tricks to fool users, and it can work.

As someone noted, not only that. But you won't see on which subreddit you are at for example. That's quite annoying.

Yeah the endgame would involve a play-store like 30% cut of any revenue, subscription, ads, anything. 30% cut from non-Google ad network revenue as well. At that point publishers won't have a choice any more because of the Chrome and Google search monopolies.

I wonder how bookmarking and auto-complete work with signed exchanges. I don't think they could ever remove the URL completely because it conflicts with their extortion scheme for AdWords where they'll sell your trademarked words to the highest bidder.

What happens if Chrome shows no URL and Google sells the AdWord for your bank's name to a malicious actor? That's a huge liability can of worms IMO.

I'm not sure the signed exchanges are all bad either. I'd rather have visitors seeing example.com than example.google.com/amp/ or google.com/amp/example.com. Isn't it better for your brand to be in the URL and bookmarks / auto-complete to go to your domain (assuming it works like that)?

I'm not convinced the whole web identity push is 100% bad. I don't trust Google, but as a general concept I think there's some technical merit in the idea.

> to fake the URL and ensure their success in becoming the gatekeepers of the internet.

They should just buy Cloudflare

> Personally I find it better for non technical people, because they can focus on the domain only. For tech people you have the option to keep the full url visible at all time, which fixes the issue.

I think a large part of my repulsion to this change is mostly because Chrome has a history of removing options constantly. A weird default with a setting to get to more expected behaviour is fine, but I have no faith in them to not remove the full url visible at all time option at this point.

Sounds about right... I am still cheesed that they're treating the address bar like where you search. For me, if the address bar does happen to go away, so does chrome.

Sorry but if you can't teach non technical users new things they shouldn't be 100 meters near a computer.

It will result in even more technical dept and people with over confidence thinking that they know what they are doing.

We don't need to idiot proof the world. We need to educate the idiots.

I already have the "Always show full URLs", so you know what I prefer, but isn't this the same or similar to Safari's default behavior for a while? I don't hear anyone still complaining about that.

The first time I used Safari and didn't see a full URL was the last time I used Safari. I didn't raise a fuss or take to twitter, I just stopped using it. I'm probably not alone.

In addition, Safari has a very small slice of browser usage in the overall scheme of things. I suspect the uproar would be just as vocal if their usage numbers were in the range of Chrome's.

Google has been doing this since 2010 [0]. Weird strawman.

0: https://bugs.chromium.org/p/chromium/issues/detail?id=41467

Firefox/Mozilla is largely funded with the search deal which is usually paid by Google.

Google has a vested interest in Firefox staying alive for competitive/monopoly reasons, especially now that IE is official a Chrome skin.

e.g. https://www.forbes.com/sites/barrycollins/2020/08/13/mozilla...

If you have a Mac safari is quite good

And for those of us who still compile ff from source and remove/add things as we please, we'll have to see people moan about something they always had and will continue to have control over, but long ago rationalized away seeking comfort in the chaining of their minds to things/ideas that are foremost in the best interest of others and not themselves.

/me shrugs

The difference is that Google likely has ulterior motives with this change, whereas in Safari, it's purely aesthetic.

Edit: I've just tried it in Chrome (enable [0] and [1] or [2]), and it's a disorienting user experience. As a matter of fact, I also just tried it in Safari, where I have similar complaints (but, again, it's easy to disable there).

[0]: chrome://flags/#omnibox-ui-sometimes-elide-to-registrable-domain

[1]: chrome://flags/#omnibox-ui-reveal-steady-state-url-path-query-and-ref-on-hover

[2]: chrome://flags/#omnibox-ui-hide-steady-state-url-path-query-and-ref-on-interaction

Yes, it has been doing it for ages, both on macOS and iOS.

This is hacker news, and you're talking about apple.

Yes. They also have ~4-5% browser market share.

No

How exactly does it help to prevent fishing from domains like my-google-account.tk?

I wonder if Livvie Lin and other Google engineers read such HN threads. What might be their internal discussions, I wonder.

How do they justify such design decisions? Are they asked by someone else to figure out how to make such wierd things happen as they just do as ordered?

It's Nanny State rationale at best, or cynical condescension -- I hate it, too. I switched from chrome back to firefox a year ago, with no loss of anything.

> Yes, I know the 95% out there who don't even know what a browser is but only know Chrome's icon gives access to the web won't understand any of this

I find it fascinating how some people in tech bubbles think everyone else is a stupid sheep who can't possibly understand such incredibly complex concepts like what a "browser" is.

> Vote with your choices (use a different browser).

You almost don't even have to. Microsoft's Edge is basically a rebranded Chrome with all of the Google stuff stripped out. You can keep using the same extensions, etc.

The average user sees http://123.45.67.89/~sk/microsoft.com/techsupport as a legitimate Microsoft website. That's what this change is intended to fix: users that see a domain in any part of the URL as being valid. They want to change it to only show the part that's actually security relevant. If you tell the average user "Look for Microsoft in the URL", and they find it in the path, they're going to fall for a phishing scam.

Protocol hiding was recently fixed, via the "Always show full URLs" option. The default is still an inconsistent mess, but checking this option makes the URL bar so much better than it's been in years.

I've thought about this as well. Tapping the URL bar on an iPhone should open a multi-line wrapping text block that doesn't require painful horizontal scrolling.

Broken on ...dots? Not slashes?

Mysite.

Com/Index.

Html

Google renewed their deal [1] and Mozilla is still going to get 400-450mil per year until 2023 at least. Yet they gutted firefox servo, devtools and MDN teams.

Using Firefox from now on is just feeding the troll called Mozilla management. We need to seek another open source privacy oriented browser or have a serious foundation like Apache fork Firefox.

[1] https://www.theregister.com/2020/08/14/mozilla_google_search...

Do they not have those AMP sites that are under a Google domain anymore?

Those are two examples where the URL is canonical and shouldn't be shortened.

There are probably many, many more. Very often the only place you can find the date of a news story is in the URL due to them using some version of Wordpress but not putting the date in the article past a certain age (F YOU, Guardian).

Google has clearly thought this through and decided that whatever they're getting out of this is FAR MORE IMPORTANT than the best interests of their users.

And that should make everyone suspicious.

I’m not sure why this is being downvoted, this is an accurate albeit sardonic description of what’s happening.

People don’t want to visit AMP sites, they want to visit the site that’s the original source for their news, etc...

"Always show full URLs" is such a breath of fresh air. It eliminates all the URL butchering (e.g. inconsistent hiding of http/https) that Chrome had been doing for more than a decade.

Though I'm not seeing the option by default on a fresh install of Chrome 86; hopefully that's just a rollout glitch.

Can confirm. Vivaldi is absolutely fantastic for the reasons you named, plus its ability to use all common Chrome extensions such as uBlock Origin, uMatrix, Dark Reader, etc.

> I don't have to worry about changing the URL too much, in order to enable deep linking and the back button. I also don't have to worry about the unsightly but useful query parameters on a search page. This should become the new standard.

I've been a web developer for both small and large companies for over 20 years and can assure you I have never worried about such things.

This is a false flag.

The new "Always show full URLs" option fixes that, because http/https is always visible.

"Won't somebody please think of the children?!"

If google can get enough people to stop using url's then they can start building a walled garden.

The official build of Chromium tracks Google Chrome quite closely, so I feel confident assuming that the change is there as well, even though I haven't checked. But since Chromium is open source, I'm not sure anyone can really answer that question. Whether the change is in Microsoft Edge depends on how far Microsoft is willing to diverge from mainline (and where specifically they want to spend their resources).

It’s sort of surreal to feel so disenfranchised about it too. Like, no one wants this, I’m sure they know that, but they just don’t care.