Google Takes Its First Steps Toward Killing the URL | WIRED
▻https://www.wired.com/story/google-chrome-kill-url-first-steps
The Chrome team’s efforts so far focus on figuring out how to detect URLs that seem to deviate in some way from standard practice. The foundation for this is an open source tool called TrickURI, launching in step with Stark’s conference talk, that helps developers check that their software is displaying URLs accurately and consistently. The goal is to give developers something to test against so they know how URLs are going to look to users in different situations. Separate from TrickURI, Stark and her colleagues are also working to create warnings for Chrome users when a URL seems potentially phishy. The alerts are still in internal testing, because the complicated part is developing heuristics that correctly flag malicious sites without dinging legitimate ones.*
For Google users, the first line of defense against phishing and other online scams is still the company’s Safe Browsing platform. But the Chrome team is exploring complements to Safe Browsing that specifically focus on flagging sketchy URLs.
Google
“Our heuristics for detecting misleading URLs involve comparing characters that look similar to each other and domains that vary from each other just by a small number of characters,” Stark says. “Our goal is to develop a set of heuristics that pushes attackers away from extremely misleading URLs, and a key challenge is to avoid flagging legitimate domains as suspicious. This is why we’re launching this warning slowly, as an experiment.”