4 ms·

I believe you're mistaken, conflating two different steps. There's still going to be a lock for HTTPS while the "Not Secure" message doesn't turn red for HTTP u

I believe you're mistaken, conflating two different steps. There's still going to be a lock for HTTPS while the "Not Secure" message doesn't turn red for HTTP until you type in a text box. The post indicates that by the time the lock disappears ("eventually"), then all HTTP sites will be marked as not secure in red. In the meantime it's removing the "Secure" text with the lock and HTTP sites will get their "Not Secure" turned red when you type in a text field. Those seem like fine steps. > That's a major regression in user security. Turning red is more functionality than today, not less.

deathanatos 8y ago
What the poster you're replying to is saying is that the reduction of contrast between secure and not (prior to anything being typed into the page) is the reduction in functionality. That is, there is now nothing eye-catchingly different between HTTP and non-HTTPs aside from a small monochrome marker; I think OP's concern is that that will get lost in people's vision next to the URL — they won't notice it. (And I somewhat agree w/ that.)
- jjoonathan 8y ago
  That's exactly the intent. Too many false positives will teach people to ignore the red marker, so putting it in place before the web catches up would be counterproductive.
lucideer 8y ago
> Turning red is more functionality than today, not less. Firstly, I didn't say it was a regression in functionality, just a regression in security (due to the loss of contrast by removing the green). Secondly, I actually did think the red was currently in place. I'm not a Chrome user, so it seems surprising to me that there is no warning currently in Chrome for entering data into insecure forms!? Firefox currently shows a red slash in the URL and an additional popup on the form input element itself which appears on focus rather than only after you've actually entered text. The Chrome team has such a good reputation for improving security on the web, so it seems bizarre to me they'd be behind on something so simple (and also not even attempting to catch up).

deathanatos 8y ago

What the poster you're replying to is saying is that the reduction of contrast between secure and not (prior to anything being typed into the page) is the reduction in functionality. That is, there is now nothing eye-catchingly different between HTTP and non-HTTPs aside from a small monochrome marker; I think OP's concern is that that will get lost in people's vision next to the URL — they won't notice it. (And I somewhat agree w/ that.)

jjoonathan 8y ago
That's exactly the intent. Too many false positives will teach people to ignore the red marker, so putting it in place before the web catches up would be counterproductive.

lucideer 8y ago

> Turning red is more functionality than today, not less. Firstly, I didn't say it was a regression in functionality, just a regression in security (due to the loss of contrast by removing the green). Secondly, I actually did think the red was currently in place. I'm not a Chrome user, so it seems surprising to me that there is no warning currently in Chrome for entering data into insecure forms!? Firefox currently shows a red slash in the URL and an additional popup on the form input element itself which appears on focus rather than only after you've actually entered text. The Chrome team has such a good reputation for improving security on the web, so it seems bizarre to me they'd be behind on something so simple (and also not even attempting to catch up).