{"id":7306,"date":"2018-09-05T14:50:09","date_gmt":"2018-09-05T18:50:09","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=7306"},"modified":"2020-08-25T11:47:54","modified_gmt":"2020-08-25T15:47:54","slug":"googles-plan-to-kill-the-url-is-a-golden-opportunity-for-certificate-authorities","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/googles-plan-to-kill-the-url-is-a-golden-opportunity-for-certificate-authorities\/","title":{"rendered":"Google\u2019s plan to kill the URL is a golden opportunity for Certificate Authorities"},"content":{"rendered":"

Who is better equipped to assist in authenticating website identity than CAs?<\/h2>\n

Google wants to kill the URL. That\u2019s the headline from Wired<\/a>. As Google Chrome turns 10 and looks to the future, its next target will be Uniform Resource Locators, or URLs.<\/p>\n

\"Google\u2019sMost people just know URLs as web addresses. The term URL is actually a bit of a misnomer because in this context we are referring to a very specific kind of URL. Typically a URL is used in conjunction with a website, but they can also be used for file transfer, email and database access.<\/p>\n

On a technical level, URLs are associated with IP addresses. Generally people are familiar with IPv4 addresses, they look something like this:<\/p>\n

97.76.174.114.<\/pre>\n
But remembering a string of numbers (or something even more complicated in the case of IPv6) for every website you want to visit would be prohibitively difficult for all but the most precise of memories. So in 1994, the inventor of the world wide web, Al Gore<\/span> Tim Berners-Lee defined URLs in RFC 1738<\/a>. We have used them to navigate the internet ever since.<\/p>\n
So why does Google want to kill the URL and why is this a major opportunity for certification authorities?<\/p>\n
Let’s hash it out…<\/span><\/p>\n<\/span><\/span>\n
Why does Google want to kill the URL?<\/h2>\n
The average internet user does not know a whole lot about web security<\/a> or what to look for when visiting a website. We are keenly aware of this because every week nearly 5,000 people read our guide on how to spot a fake website<\/a>. So, asking users to know what to look for within the URL itself is not going to yield good results.<\/p>\n
In fact, just displaying the URL<\/a> is a problem for browsers, especially with their mobile versions<\/a>.<\/p>\n
RELATED: <\/strong><\/em>How popular iOS apps display URLs<\/em><\/a><\/p>\n
Eric Lawrence<\/a>, a former Googler currently in his second stint with Microsoft, has written about a concept that is extremely informative when trying to understand browser security and where Google is coming from on this. It\u2019s called the line of death<\/a>. The idea is this: the browser can only control the top of the window, none of the pixels below the so-called line of death can be trusted.<\/p>\n
If a user trusts pixels above the line of death, the thinking goes, they\u2019ll be safe, but if they can be convinced to trust the pixels below the line, they\u2019re gonna die.<\/p><\/blockquote>\n
One of the things that Lawrence, the browser community as a whole and specifically Google have realized though is that some (for lack of a better term) attacker data does make it above the line of death.<\/p>\n
\"Example<\/p>\n
The web page\u2019s title and icon (1) are controlled by the website itself. But the more problematic area is the address bar. As we already covered, people really don\u2019t understand URLs. And hackers and cyber criminals are acutely aware of this<\/a> and use it to their advantage on a near constant basis<\/a>.<\/p>\n
This is an example of a URL:<\/p>\n
\"Google\u2019s<\/p>\n
Ideally, people could look at the domain itself and get a sense of website identity. But again, as we mentioned earlier, the reality is that browsers can\u2019t rely on their users to discern a legitimate URL from a fake one.<\/p>\n
Website identity continues to be a major issue.<\/p>\n
“People have a really hard time understanding URLs,” Adrienne Porter Felt, Chrome’s engineering manager told Wired<\/a>. “They\u2019re hard to read, it\u2019s hard to know which part of them is supposed to be trusted, and in general I don\u2019t think URLs are working as a good way to convey site identity. So we want to move toward a place where web identity is understandable by everyone\u2014they know who they\u2019re talking to when they\u2019re using a website and they can reason about whether they can trust them. But this will mean big changes in how and when Chrome displays URLs. We want to challenge how URLs should be displayed and question it as we\u2019re figuring out the right way to convey identity.”<\/p><\/blockquote>\n
Google doesn\u2019t have any idea what to replace URLs with<\/h2>\n
The problem Google is facing is that it doesn\u2019t exactly have a URL replacement handy. It knows a change needs to be made but it doesn\u2019t know what that change should be.<\/p>\n
Right now Google says its main focus is just identifying all the ways people use URLs.<\/p>\n
Eventually, the idea will be to replace the URL with something that is not only more user-friendly, but that also enhances security and provides authenticated website identity information.<\/p>\n
“I don\u2019t know what this will look like, because it\u2019s an active discussion in the team right now,” said Parisa Tabriz<\/a>, the director of engineering at Chrome. “But I do know that whatever we propose is going to be controversial. That\u2019s one of the challenges with a really old and open and sprawling platform. Change will be controversial whatever form it takes. But it\u2019s important we do something, because everyone is unsatisfied by URLs. They kind of suck.”<\/p><\/blockquote>\n
This is not the first time Google has tried something like this. Back in 2014 it briefly tried to replace URLs with \u201corigin chips<\/a>\u201d that only displayed the domain name. But it paused on that before it ever got to an official release because of push-back from users.<\/p>\n
Lately Google’s initiatives to change the web have gone a little more smoothly, as evidence by its push to mandate HTTPS<\/a> earlier this year. And even before announcing its intentions, Google was already tinkering with URLs. It announced plans to phase out showing the protocol at the beginning of the URL with Chrome 69<\/a>, which is literally being rolled out to its users as you read this.<\/p>\n
Per Porter Felt, Google plans to speak publicly about its plans to further deprecate the URL either this Fall or next Spring.<\/p>\n
Google\u2019s plan to kill the URL is a golden opportunity for certification authorities<\/h2>\n
At the heart of any changes to the use of URLs will be the need to assert website identity<\/a>. This has never been more crucial than it is right now with phishing at an all-time high<\/a> and a range of malicious actors using social engineering to phish<\/a> and defraud internet users.<\/p>\n
Perhaps no industry is better suited to assist in authenticating various identities \u2013 end entity ID, machine ID, website ID, corporate ID \u2013 than the Certificate Authorities that issue digital certificates.<\/p>\n
There has already been a push to decouple business authentication from SSL<\/strong>, the thinking being that SSL\/TLS serves its function as a security mechanism but struggles with the authentication aspects. This would be the perfect opportunity to fix that.<\/p>\n
\"Google\u2019sCAs already have the infrastructure built out to validate businesses and other entities, helping them to assert their corporate and web identities.<\/p>\n
Let\u2019s put that to use finding a replacement for URLs that can both enhance security while also helping businesses and organizations assert their identity in a way that is unmistakable to internet users.<\/p>\n
Obviously, not every website would need extensive authentication, but there are myriad businesses and other organizations that could make ample use of a mechanism that more visibly confirms their identity to its customers or users.<\/p>\n
Authenticating identities is probably not something most of the browser community would want to take responsibility for. While Microsoft, Apple and Google all have the resources to do it, putting together that kind of apparatus would take considerable time. It also seems fairly out of scope for all three corporations.<\/p>\n
No, authentication would need to be outsourced, and the CA industry is in perfect position to step into that role.<\/p>\n
There would still be a lot of work that needs to be done. Regardless of whether it\u2019s decoupled from SSL\/TLS or not, Extended Validation needs to be strengthened. And we would need to find a way to display the information that avoids name collisions or confusion over which entity you\u2019re transacting with. But this is a golden opportunity for certificate authorities to realize a new future where identity continues to exist at the core of everything we do.<\/p>\n
The future may be calling, now it’s time to figure out if we’re ready to answer.<\/p>\n
As always, leave any comments or questions below…<\/em><\/p>\n
\"Hashed<\/p>\n","protected":false},"excerpt":{"rendered":"
Who is better equipped to assist in authenticating website identity than CAs? Google wants to kill the URL. That\u2019s the headline from Wired. As Google Chrome turns 10 and looks…<\/p>\n","protected":false},"author":6,"featured_media":7309,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[17],"tags":[164,1018,131,1019],"class_list":["post-7306","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-lowdown","tag-certificate-authorities","tag-eliding","tag-google","tag-urls","post-with-tags"],"views":23333,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/09\/bigstock-Search-Bar-With-Www-Text-Web-226570972.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/7306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=7306"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/7306\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/7309"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=7306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=7306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=7306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}