You are right, maybe the browser UX should have been to mark sites as: - "Not secure" for HTTP - "Low security" for HTTPS encrypted but not authenticated (MIT

You are right, maybe the browser UX should have been to mark sites as: - "Not secure" for HTTP - "Low security" for HTTPS encrypted but not authenticated (MITM still possible) - "High security" for HTTPS encrypted and authenticated