3 ms·
HTTP was never marked as secure. Mixed content was marked insecure because there were assets on the page that might not be from where you think they were from.
by mhurron 11y ago
HTTP was never marked as secure.
Mixed content was marked insecure because there were assets on the page that might not be from where you think they were from. It was an indicator that the little https lock in the URL bar wasn't telling you the whole story.
- ethbro 11y agoI think this is at the core of Google's thinking on this: unless presented with a negative, users' assumptions are that they're secure. Which is fair, given that I bet you'd get about a 5% or less recognition rate if you polled a random sampling of people on whether they could define "HTTPS" / "SSL" / "TLS" / "That lock thingie" to any degree of accuracy. A server shouldn't have the opportunity to serve an insecure connection to the user without the user being made explicitly aware of that fact.