4 ms·

Removing the lock entirely is just wrong. It’s a really quick indicator that I’ve either set something up right or not. Also if I’m on chase.com and I don’t s

Removing the lock entirely is just wrong. It’s a really quick indicator that I’ve either set something up right or not. Also if I’m on chase.com and I don’t see a lock of any kind I’m going to NOPE out. And I’m a tech person. Imagine explaining to my parents that after all this training to look for the lock they now shouldn’t look for the lock, but look for this red text instead. Bad move.

dangrossman 8y ago
Not only that, but the red text doesn't appear until it's too late: AFTER they've put their sensitive information into a form, which probably spirited it away with JavaScript before one can change their mind.
- andyjh 8y ago
  Not true: Currently the "info" indicator appears on first interaction (which _could_ be after they've auto-completed everything, but may not be). This is changing though: In Chrome 68 the info indicator will be there on all HTTP pages, without form interaction required. So this change just changes it from "info" to red warning.
  - weber111 8y ago
    If you type fast, you can probably get a whole username (or personal name, or street address) in without seeing the red warning. (That said, it looks like it _will_ show "not secure" by default, even before you type anything in, on HTTP; it just isn't emphasized unless you enter data.)
mtgx 8y ago
I think the best compromise is to at least show HTTPS in green. Not showing anything at all seems wrong somehow. I understand why they don't want to show "Secure" for websites that may have already been breached and lost your plaintext password. But I don't understand why they need to remove https and http from the URL. Is that really a big UX step forward? Or one backwards? Sometimes removing too many interface elements causes a regression in intuitiveness and good UX. Unless they're preparing for the replacement of the HTTP protocol, and they don't want people to freak out when they see the new labels? That could explain it. But other than that, I don't see a good reason for eliminating HTTPS/HTTP from the URL.
- callalex 8y ago
  They aim to replace https with quic when it’s ready for prime time.
  - f2n 8y ago
    Do you have a source for that? I assumed the lessons learned from SPDY and QUIC eventually went into HTTP 2
jaas 8y ago
The problem with the lock is that people think it means a site is safe (i.e. contents are safe). That's not what it means and you're never going to educate enough people about what it really means, nor should you have to. It's grossly misleading and it needs to go.
mynameisvlad 8y ago
> It’s a really quick indicator that I’ve either set something up right or not. That indicator just changes to either showing nothing (good) or showing an info icon with "Not Secure" (bad). There's still an indicator there, it's just different.

dangrossman 8y ago

Not only that, but the red text doesn't appear until it's too late: AFTER they've put their sensitive information into a form, which probably spirited it away with JavaScript before one can change their mind.

andyjh 8y ago
Not true: Currently the "info" indicator appears on first interaction (which _could_ be after they've auto-completed everything, but may not be). This is changing though: In Chrome 68 the info indicator will be there on all HTTP pages, without form interaction required. So this change just changes it from "info" to red warning.
- weber111 8y ago
  If you type fast, you can probably get a whole username (or personal name, or street address) in without seeing the red warning. (That said, it looks like it _will_ show "not secure" by default, even before you type anything in, on HTTP; it just isn't emphasized unless you enter data.)

mtgx 8y ago

I think the best compromise is to at least show HTTPS in green. Not showing anything at all seems wrong somehow. I understand why they don't want to show "Secure" for websites that may have already been breached and lost your plaintext password. But I don't understand why they need to remove https and http from the URL. Is that really a big UX step forward? Or one backwards? Sometimes removing too many interface elements causes a regression in intuitiveness and good UX. Unless they're preparing for the replacement of the HTTP protocol, and they don't want people to freak out when they see the new labels? That could explain it. But other than that, I don't see a good reason for eliminating HTTPS/HTTP from the URL.

callalex 8y ago
They aim to replace https with quic when it’s ready for prime time.
- f2n 8y ago
  Do you have a source for that? I assumed the lessons learned from SPDY and QUIC eventually went into HTTP 2

jaas 8y ago

The problem with the lock is that people think it means a site is safe (i.e. contents are safe). That's not what it means and you're never going to educate enough people about what it really means, nor should you have to. It's grossly misleading and it needs to go.

mynameisvlad 8y ago

> It’s a really quick indicator that I’ve either set something up right or not. That indicator just changes to either showing nothing (good) or showing an info icon with "Not Secure" (bad). There's still an indicator there, it's just different.