5 ms·

Why is it you (or someone there) chose "Secure" in the address bar rather than something like "Private"? It seems like the people who don't understand what http

Why is it you (or someone there) chose "Secure" in the address bar rather than something like "Private"? It seems like the people who don't understand what httpS means at all see "Secure" and think "oh this site is safe/secure" no matter what this site is, like if it's a phishing site. I'm not one to be very pedantic, but "Secure" up there really doesn't mean "Secure" at all. I know what it means, but people falling for dangerous sites don't get that at all. I don't really know what the best word is, but "Secure" seems like not the best choice there. [Edit] Thank you to those people who had some honest replies, not sure why this got down voted, it was an honest question. When you go to the "Learn More" page on Chrome it doesn't even say "Secure" it says "Information you send or get through the site is private."

kaycebasques 9y ago
Words are hard. Anyone got an idea for a better word? Send your ideas to the security-dev mailing list (at least, I think that's the best forum...): https://groups.google.com/a/chromium.org/forum/#!forum/security-dev https://groups.google.com/a/chromium.org/forum/#!forum/secur...
- ryandvm 9y ago
  How about all it really means? "Encrypted"
  - sverhagen 9y ago
    ESL, myself, but I wouldn't know if Encrypted makes a lot of sense for non-technical users?
  - rocqua 9y ago
    HTTPS means more than just encryption. There is also authentication and integrity guarantees in SSL.
    - berbec 9y ago
      But the extras beyond encryption are definately not guarantees. [1] HTTPS means encrypted HTTP. Everything else is "I trust the certificate authority to provide oversight and verification." It may just be me, but I don't trust the fine, upstanding CAs we have now-a-days. 1: https://stripe.ian.sh/ https://stripe.ian.sh/
      - rocqua 9y ago
        Authenticity indeed is only guaranteed if you trust the CAs. Though it is still nice to know that getting a false cert isn't trivial. However, message integrity is a real benefit of SSL that doesn't need CAs. Consider the original article. In this case encryption doesn't matter and integrity does. Without message integrity, considering the login link has a known location and value, using bit-flips one might be able to change the login link (depending on the kind of encryption used). This message integrity is getting to be a much more important part of https. There are a lot of things that you don't want other parties able to change. Maybe even more things than you don't want them to be able to read.
    - ryandvm 9y ago
      That's my point. There is no guarantee about authenticity. Anyone can register a domain and have an SSL cert from Let's Encrypt in less than 15 minutes. The only thing that HTTPS guarantees is that you are communicating securely with the person that owns the domain. That's it.
- ChrisSD 9y ago
  Perhaps the reverse would be better. If a site doesn't use HTTPS, call it unsecured.
  - tialaramex 9y ago
    This is expected to be the long term outcome of (at least) Google and Mozilla's current trajectory. Google specifically says (without naming a date) that their long term intent is to put a UI like a red triangle plus the phrase "Not Secure" in the URL bar for all HTTP sites on their desktop browser. This is the same treatment you get today for a site with a bogus SSL certificate and similar to the treatment HTTP sites get now in Incognito mode.
UncleMeat 9y ago
This is bikeshedding. The only users who would be able to distinguish the meaning of "secure" and "private" in their address bar are people who already understand what https is and isn't.
- blakesterz 9y ago
  This was an honest question, really. I didn't say I had the right answer, I was wondering why they chose "Secure"
  - UncleMeat 9y ago
    Fair. Its just that this very complaint has been brought up by a number of people asking it dishonestly as a way of discouraging the move towards ssl on all websites. That's why it raises eyebrows.
  - ascorbic 9y ago
    I'd imagine it's because that's what the S stands for.
nkkollaw 9y ago
Couldn't "private" also not mean "private"? For instance: when you're on Facebook, couldn't people think they are exchanging private messages because the address bar says "private"? "secure" means "secure connection" to me, and it sounds perfectly appropriate. Maybe you can't find a better term for "secure" because it's perfectly fine, already..?
- blakesterz 9y ago
  > Maybe you can't find a better term for "secure" because it's perfectly fine, already..? Could be! Someone else suggested "Encrypted", seems like a good word. I really don't know.
  - nkkollaw 9y ago
    If you're looking to be user-friendly, I'm not sure "encrypted" would work, because many people aren't going to know what it means. I'm thinking specially in its inactive "not encrypted" version, where people aren't going to appreciate the gravity of a page being "not encrypted". I bet the folks at Google already thought about this through.

kaycebasques 9y ago

Words are hard. Anyone got an idea for a better word? Send your ideas to the security-dev mailing list (at least, I think that's the best forum...): https://groups.google.com/a/chromium.org/forum/#!forum/security-dev https://groups.google.com/a/chromium.org/forum/#!forum/secur...

ryandvm 9y ago
How about all it really means? "Encrypted"
- sverhagen 9y ago
  ESL, myself, but I wouldn't know if Encrypted makes a lot of sense for non-technical users?
- rocqua 9y ago
  HTTPS means more than just encryption. There is also authentication and integrity guarantees in SSL.
  - berbec 9y ago
    But the extras beyond encryption are definately not guarantees. [1] HTTPS means encrypted HTTP. Everything else is "I trust the certificate authority to provide oversight and verification." It may just be me, but I don't trust the fine, upstanding CAs we have now-a-days. 1: https://stripe.ian.sh/ https://stripe.ian.sh/
    - rocqua 9y ago
      Authenticity indeed is only guaranteed if you trust the CAs. Though it is still nice to know that getting a false cert isn't trivial. However, message integrity is a real benefit of SSL that doesn't need CAs. Consider the original article. In this case encryption doesn't matter and integrity does. Without message integrity, considering the login link has a known location and value, using bit-flips one might be able to change the login link (depending on the kind of encryption used). This message integrity is getting to be a much more important part of https. There are a lot of things that you don't want other parties able to change. Maybe even more things than you don't want them to be able to read.
  - ryandvm 9y ago
    That's my point. There is no guarantee about authenticity. Anyone can register a domain and have an SSL cert from Let's Encrypt in less than 15 minutes. The only thing that HTTPS guarantees is that you are communicating securely with the person that owns the domain. That's it.
ChrisSD 9y ago
Perhaps the reverse would be better. If a site doesn't use HTTPS, call it unsecured.
- tialaramex 9y ago
  This is expected to be the long term outcome of (at least) Google and Mozilla's current trajectory. Google specifically says (without naming a date) that their long term intent is to put a UI like a red triangle plus the phrase "Not Secure" in the URL bar for all HTTP sites on their desktop browser. This is the same treatment you get today for a site with a bogus SSL certificate and similar to the treatment HTTP sites get now in Incognito mode.

UncleMeat 9y ago

This is bikeshedding. The only users who would be able to distinguish the meaning of "secure" and "private" in their address bar are people who already understand what https is and isn't.

blakesterz 9y ago
This was an honest question, really. I didn't say I had the right answer, I was wondering why they chose "Secure"
- UncleMeat 9y ago
  Fair. Its just that this very complaint has been brought up by a number of people asking it dishonestly as a way of discouraging the move towards ssl on all websites. That's why it raises eyebrows.
- ascorbic 9y ago
  I'd imagine it's because that's what the S stands for.

nkkollaw 9y ago

Couldn't "private" also not mean "private"? For instance: when you're on Facebook, couldn't people think they are exchanging private messages because the address bar says "private"? "secure" means "secure connection" to me, and it sounds perfectly appropriate. Maybe you can't find a better term for "secure" because it's perfectly fine, already..?

blakesterz 9y ago
> Maybe you can't find a better term for "secure" because it's perfectly fine, already..? Could be! Someone else suggested "Encrypted", seems like a good word. I really don't know.
- nkkollaw 9y ago
  If you're looking to be user-friendly, I'm not sure "encrypted" would work, because many people aren't going to know what it means. I'm thinking specially in its inactive "not encrypted" version, where people aren't going to appreciate the gravity of a page being "not encrypted". I bet the folks at Google already thought about this through.