[snthd]

"private secure links" are indistinguishable from any other link.

With HTTP auth links you know the password is a password, so these tools would know which part to hide from public display:

> https://username:[e-mail]/page

[jeroenhd]

I think it's quite funny that the URL spec has a section dedicated to authentication, only for web devs to invent ways to pass authentication data in any way but using the built-in security mechanism.

I know there are valid reasons (the "are you sure you want to log in as usernam on example.com?" prompt for example) but this is just one of the many ways web dev has built hacks upon hacks where implementing standards would've sufficed. See also: S3 vs WebDAV.