2 ms·
What if it just showed all HTTP and self-signed HTTPS site address bars with a light red background, instead? It would immediately jump out at you on Gmail that
by byuu 10y ago
What if it just showed all HTTP and self-signed HTTPS site address bars with a light red background, instead? It would immediately jump out at you on Gmail that something was wrong. Chrome wants to eventually indicate all HTTP sites are insecure, so this is a good way to achieve their goal, is it not?
It doesn't matter whether you believe their actions are altruistic (protect everyone!) or sinister (protect the CAs!) ... by treating self-signed certificates as worse than nothing, they send a pretty clear signal to independents that it's the latter. Treating them both the same would be a great step toward building confidence to those who don't trust their actions currently.