5 ms·

Who cares about warnings? Do your users browse with devtools open? At worst the users see the grey "i" in circle icon: https://googlesamples.github.io/web-fund

• bjacobel 10y ago
  A single HTTP request in an otherwise HTTPS page can compromise the privacy and integrity of a user's connection. SSL/TLS isn't just about checking all the boxes so Chrome will give you the prettier icon, there are real stakes for users.
  • andrewmunsell 10y ago
    To expand on this-- Imagine you have a website with a payment form on an HTTPS page, but you embed some external analytics script over HTTP. If your visitor's request is MITMed (e.g. they're in a coffee shop or some other insecure WiFi access point, etc), then an attacker can modify the script (that's over HTTP) to send these credit card details to the attacker's server. Once there's a single HTTP resource on the page, HTTPS means a whole lot less, hence the scary warnings.
    • baybal2 10y ago
      >Once there's a single HTTP resource on the page, HTTPS means a whole lot less, hence the scary warnings. More like if there is a single line of 3rd party code.
• kuschku 10y ago
  No, they see a yellow warning icon instead of the green https, and in some browsers the https is even red, and strikethrough. That's quite concerning as far as warning signs go. And I don't want to have to compromise the users safety by switching entirely back to HTTP, which would just give no warning.