[Endy]

Personal responsibility is the main benefit; teaching people to look twice at what they do on the Internet. And frankly speaking, if manual user entry is less secure than software that the user does not own from metal to UI, then we need to upgrade the users, not the Web. Demanding a manual entry means that the user is taking deliberate action, not following whatever some piece of software is telling them to be correct.

[joshuamorton]

Personal responsibility, in and of itself, is not usually considered to be a benefit. It is considered a thing one has to undertake to achieve a benefit.

You seem to be suggesting that if I intend to visit mywebsite.com, that typing "myw", seeing "mywebsite.com", and hitting enter is somehow less deliberate than typing "mywebsit.com" and going to a site that was not my intent.

Given that only the first one of these things reflects my intent, describing the second as deliberate and the first as not-deliberate requires some odd twisting of definitions.

Your fear, it seems to be, is that tools we use might influence how we act. This is nothing new. Stories started to rhyme less when we figured out how to write things instead of memorizing them. That was still probably undoubtedly an improvement. So can you perhaps clarify what specific influences that our tools have might be bad? For example, my browser suggesting "mywatertower.com" instead of "mywebsite.com" because the first paid for a higher position.

That seems a reasonable end state to fear, but I have no reason to believe we're heading that direction. Do you? Is inconveniencing (literally) billions of people and forcing them to take less secure paths to do what they want worth avoiding a possibility that certainly doesn't seem imminent?

[Endy]

To me, it's definitely worth it to "inconvenience" people and demand conscious behavior. With the largest browser vendor being the largest advertising agency and the largest search engine, encouraging anyone to have anything beyond the barest minimum to do with them goes against everything I believe in. Search engines should not be able to intercede in direct Web activity; they should be used for content discovery and nothing else. You should not be able to type three letters and get a full URL unless you personally wrote a macro to do that.

Then again, when users stopped having to specify protocol for every server, that was probably the beginning of the end of deliberate browsing. My fear is really that people take the Web and the Internet as a whole for granted; and I want to see procedures put in place to demand that all users be aware of their actions, what data they share with servers, and all of what's being downloaded to their computer.

I don't like having to remind people that there is no "Cloud", only someone else's computer. And you're saying you trust that other person's machine and security more than your own by storing critical data there. Or pointing out what having one CDN for so much of the Web did last month.

[joshuamorton]

> You should not be able to type three letters and get a full URL unless you personally wrote a macro to do that.

Should you be unable to drive unless you can, IDK, build an automatic transmission? This point of view reduces, as far as I can tell, to the idea that good user interfaces should only be extended to those privileged with enough expertise to build them themselves.

This requires a level of literacy that most users will never be able to meet, by virtue of most people not having time to learn a programming language since they have other responsibilities.

It's also not clear why you aren't extending this backwards: why is it okay to use a browser I didn't write myself (or at least compile from source)? What about my OS? Do you really expect every user to have full knowledge of their entire system? That puts severe limits on the potential tooling we can use, and goes counter to one of the core ideas of software engineering: abstraction.

> And you're saying you trust that other person's machine and security more than your own by storing critical data there.

Yes, I trust security teams and engineers whose job is security and reliability more so than I trust myself, in much the same way that I'd trust a surgeon to do surgery better than myself. I realize that there's certification/training differences that may be relevant, but in general, the same ideas apply.