4 ms·

The biggest problem here is not that the green lock is being eliminated, but rather that HTTP pages will show a low-contrast grey message unless and until you t

The biggest problem here is not that the green lock is being eliminated, but rather that HTTP pages will show a low-contrast grey message unless and until you type into an input. By default, if you're not typing in a form, Chrome will show no major eye-catching colour-differentiation between HTTP and HTTPS. That's a major regression in user security.

dangrossman 8y ago
It's not easy to explain to your parents either. "Don't look for the padlock any more, just look for a Not Secure warning... which may not appear until AFTER you put in your credit card details... at which point it's not really helped you at all has it. Huh. I have no idea what Google was thinking here. Better call the bank and cancel your credit card every time Not Secure pops up."
- RussianCow 8y ago
  To be fair, the "Not Secure" message is always there—it only changes color to red once you start typing into a form field. I do think it should be red by default, because the gray is not obvious enough, but I don't think it's necessarily any harder to explain than the green padlock.
  - eco 8y ago
    It's kind of a weird how it works. Users will be looking at the field they are typing on (or even the keyboard for some users). Then they'll look down for the next field and so on until they reach submit. I think users will often miss the color change entirely. I think it'd make more sense to just make it red if there is any input options on the page at all.
    - cpeterso 8y ago
      Firefox shows an insecure warning in the insecure form field itself so the user will see it.
    - Ajedi32 8y ago
      An attacker could probably emulate a form in JavaScript without using any actual input fields. Displaying the indicator on user input seems much more difficult to bypass.
- nikanj 8y ago
  "If it says Not Secure, it's definitely not secure. If it doesn't say that, it's probably not secure anyway."
andyjh 8y ago
No, as of chrome 68, http will be marked as not secure without waiting for any user interaction at all. The change for http pages outlined in this post is to upgrade that from the grey info message to a red warning.
magicalist 8y ago
I believe you're mistaken, conflating two different steps. There's still going to be a lock for HTTPS while the "Not Secure" message doesn't turn red for HTTP until you type in a text box. The post indicates that by the time the lock disappears ("eventually"), then all HTTP sites will be marked as not secure in red. In the meantime it's removing the "Secure" text with the lock and HTTP sites will get their "Not Secure" turned red when you type in a text field. Those seem like fine steps. > That's a major regression in user security. Turning red is more functionality than today, not less.
- deathanatos 8y ago
  What the poster you're replying to is saying is that the reduction of contrast between secure and not (prior to anything being typed into the page) is the reduction in functionality. That is, there is now nothing eye-catchingly different between HTTP and non-HTTPs aside from a small monochrome marker; I think OP's concern is that that will get lost in people's vision next to the URL — they won't notice it. (And I somewhat agree w/ that.)
  - jjoonathan 8y ago
    That's exactly the intent. Too many false positives will teach people to ignore the red marker, so putting it in place before the web catches up would be counterproductive.
- lucideer 8y ago
  > Turning red is more functionality than today, not less. Firstly, I didn't say it was a regression in functionality, just a regression in security (due to the loss of contrast by removing the green). Secondly, I actually did think the red was currently in place. I'm not a Chrome user, so it seems surprising to me that there is no warning currently in Chrome for entering data into insecure forms!? Firefox currently shows a red slash in the URL and an additional popup on the form input element itself which appears on focus rather than only after you've actually entered text. The Chrome team has such a good reputation for improving security on the web, so it seems bizarre to me they'd be behind on something so simple (and also not even attempting to catch up).

dangrossman 8y ago

It's not easy to explain to your parents either. "Don't look for the padlock any more, just look for a Not Secure warning... which may not appear until AFTER you put in your credit card details... at which point it's not really helped you at all has it. Huh. I have no idea what Google was thinking here. Better call the bank and cancel your credit card every time Not Secure pops up."

RussianCow 8y ago
To be fair, the "Not Secure" message is always there—it only changes color to red once you start typing into a form field. I do think it should be red by default, because the gray is not obvious enough, but I don't think it's necessarily any harder to explain than the green padlock.
- eco 8y ago
  It's kind of a weird how it works. Users will be looking at the field they are typing on (or even the keyboard for some users). Then they'll look down for the next field and so on until they reach submit. I think users will often miss the color change entirely. I think it'd make more sense to just make it red if there is any input options on the page at all.
  - cpeterso 8y ago
    Firefox shows an insecure warning in the insecure form field itself so the user will see it.
  - Ajedi32 8y ago
    An attacker could probably emulate a form in JavaScript without using any actual input fields. Displaying the indicator on user input seems much more difficult to bypass.
nikanj 8y ago
"If it says Not Secure, it's definitely not secure. If it doesn't say that, it's probably not secure anyway."

andyjh 8y ago

No, as of chrome 68, http will be marked as not secure without waiting for any user interaction at all. The change for http pages outlined in this post is to upgrade that from the grey info message to a red warning.

magicalist 8y ago

I believe you're mistaken, conflating two different steps. There's still going to be a lock for HTTPS while the "Not Secure" message doesn't turn red for HTTP until you type in a text box. The post indicates that by the time the lock disappears ("eventually"), then all HTTP sites will be marked as not secure in red. In the meantime it's removing the "Secure" text with the lock and HTTP sites will get their "Not Secure" turned red when you type in a text field. Those seem like fine steps. > That's a major regression in user security. Turning red is more functionality than today, not less.

deathanatos 8y ago
What the poster you're replying to is saying is that the reduction of contrast between secure and not (prior to anything being typed into the page) is the reduction in functionality. That is, there is now nothing eye-catchingly different between HTTP and non-HTTPs aside from a small monochrome marker; I think OP's concern is that that will get lost in people's vision next to the URL — they won't notice it. (And I somewhat agree w/ that.)
- jjoonathan 8y ago
  That's exactly the intent. Too many false positives will teach people to ignore the red marker, so putting it in place before the web catches up would be counterproductive.
lucideer 8y ago
> Turning red is more functionality than today, not less. Firstly, I didn't say it was a regression in functionality, just a regression in security (due to the loss of contrast by removing the green). Secondly, I actually did think the red was currently in place. I'm not a Chrome user, so it seems surprising to me that there is no warning currently in Chrome for entering data into insecure forms!? Firefox currently shows a red slash in the URL and an additional popup on the form input element itself which appears on focus rather than only after you've actually entered text. The Chrome team has such a good reputation for improving security on the web, so it seems bizarre to me they'd be behind on something so simple (and also not even attempting to catch up).