FWIW, "the padlock is enough" is quite the opposite of Google's position: https://blog.chromium.org/2018/05/evolving-chromes-security-indicators.html https://b

FWIW, "the padlock is enough" is quite the opposite of Google's position: https://blog.chromium.org/2018/05/evolving-chromes-security-indicators.html https://blog.chromium.org/2018/05/evolving-chromes-security-... and in fact one of the main reasons is that use of HTTPS is far too little information for the browser to affirmatively indicate "This site is secure and trustworthy." So they are planning to get rid of the padlock. (Use of HTTP is enough for the browser to affirmatively say it's insecure, though.) So I think Google understands that one of the consequences of pervasive HTTPS is that the padlock is at best meaningless and at worst misleading, as we saw here.