It sounds to me like this is more of a problem with the <i>domain</i> system, and the way it embeds into a URL, than a problem with URLs as a whole. Browsers have already largely hacked off the protocol in the front, and even Google couldn't get rid of the path & querystring (though we can continue to work towards hiding more of it from the average user if that is desirable), so it seems likely this is all about the domain, and the difficulty of mapping what domains really mean to what end users think it means.<p>To boil it down to one example, how do you solve the problem of someone setting up secure.citigroup.accountmanagement.com and have an end-user understand that that's a phishing site? I mean, for goodness' sake, authority in the DNS chain is read <i>backwards</i>. How many users are going to read that and see ".com" as the root and technically most important element, rather than "secure"?<p>I'm not commenting on any possible solution since this article doesn't even sketch one. I'm just trying to apply the principle-of-charity to the article and come up with the most plausible interpretation, and the one most interesting to have a discussion about.<p>My own commentary is that I'm not sure if there is an answer that's any better than beating on domain names until they work as well as possible. The only other alternative I see is a centralized authority of some sort, and while that is likely to potentially work better than what we have now for maybe about 5 years, the negative consequences after that as the central authority learns to spread its wings and exert control to extract money from people and abuse its authority to push some agenda outweigh the safety.