4 ms·

Google will retire Chrome’s HTTPS padlock icon as no one knows what it means

13 points by LinuxBender 4y ago

lionkor 4y ago
> The Chromium team says that Chrome will continue to alert users in the address bar when a site isn't using HTTPS
freedomben 4y ago
> "the precise meaning of the lock icon." I don't think many people need to know "the precise meaning" for it to be useful/meaningful. We've taught everybody that "the lock" needs to be there for it to be secure. So many times we've said, "if there's no lock, never ever ever put in your password or payment info, etc." Now that we've spent the last 10 years of corproate security awareness training pounding into our users' heads that "if you don't see the lock icon, it's insecure," now we get to explain that the opposite is now true.
- _k8pl 4y ago
  The problem is people taking "No lock means it's insecure and untrustworthy" and interpreting it as "No lock makes it untrustworthy, so clearly a lock makes is trustworthy." Not helped by the worrying amount of security "education" that explicitly states that the lock icon is a symbol of trustworthiness. Ultimately this is obvious to technical people: The lock describes the transport layer, and says nothing about the content. But because public technical understanding is so poor, we get the aforementioned misconception. IMO the change is a good one. HTTPS should be seen as the default, with warnings for HTTP. (Though it shouldn't go further - in my opinion HTTP should still be accessible without the kind of security warnings you get for invalid certs etc)
  - freedomben 4y ago
    That's a good point about the inverse being implied (that lock means trustworthy) which is not correct or safe. I suppose to some extent we're between a rock and hard place currently.
- rudasn 4y ago
  > Now that we've spent the last 10 years of corproate security awareness training pounding into our users' heads [..] Just today I was trying to pay my car insurance online via a local payments gateway. After two 2FA sms authentication, one for the insurance one for the gateway, I am presented with yet another 2fa (?) screen on the gateways website to give my password for my online banking account. They, the third party gateway, were kind enough to show me the last 3 digits of my banking username, just in case I forgot who I am during the process. So I call my bank to let them know, "guys wtf is going on, they're asking for my password", to which they reply "oh don't worry, that's fine, that's how we do verification now, nobody will see your password". :0
nailer 4y ago
No one knows what it means, but it’s provocative. It gets the people going.
hulitu 4y ago
> Google will retire Chrome’s HTTPS padlock icon as no one knows what it means Hopefuly they will retire all the icons because only Google knows what they mean. /s
1MachineElf 4y ago
I'm surprised this isn't an April Fools joke. Their proposed tune icon is dramatically less intuitive. It would be funny if it weren't for the fact that going against the traditional lock icon is a massive step back in security UI.

13 points by LinuxBender 4y ago

> The Chromium team says that Chrome will continue to alert users in the address bar when a site isn't using HTTPS

> "the precise meaning of the lock icon." I don't think many people need to know "the precise meaning" for it to be useful/meaningful. We've taught everybody that "the lock" needs to be there for it to be secure. So many times we've said, "if there's no lock, never ever ever put in your password or payment info, etc." Now that we've spent the last 10 years of corproate security awareness training pounding into our users' heads that "if you don't see the lock icon, it's insecure," now we get to explain that the opposite is now true.

_k8pl 4y ago
The problem is people taking "No lock means it's insecure and untrustworthy" and interpreting it as "No lock makes it untrustworthy, so clearly a lock makes is trustworthy." Not helped by the worrying amount of security "education" that explicitly states that the lock icon is a symbol of trustworthiness. Ultimately this is obvious to technical people: The lock describes the transport layer, and says nothing about the content. But because public technical understanding is so poor, we get the aforementioned misconception. IMO the change is a good one. HTTPS should be seen as the default, with warnings for HTTP. (Though it shouldn't go further - in my opinion HTTP should still be accessible without the kind of security warnings you get for invalid certs etc)
- freedomben 4y ago
  That's a good point about the inverse being implied (that lock means trustworthy) which is not correct or safe. I suppose to some extent we're between a rock and hard place currently.
rudasn 4y ago
> Now that we've spent the last 10 years of corproate security awareness training pounding into our users' heads [..] Just today I was trying to pay my car insurance online via a local payments gateway. After two 2FA sms authentication, one for the insurance one for the gateway, I am presented with yet another 2fa (?) screen on the gateways website to give my password for my online banking account. They, the third party gateway, were kind enough to show me the last 3 digits of my banking username, just in case I forgot who I am during the process. So I call my bank to let them know, "guys wtf is going on, they're asking for my password", to which they reply "oh don't worry, that's fine, that's how we do verification now, nobody will see your password". :0

nailer 4y ago

No one knows what it means, but it’s provocative. It gets the people going.

hulitu 4y ago

> Google will retire Chrome’s HTTPS padlock icon as no one knows what it means Hopefuly they will retire all the icons because only Google knows what they mean. /s

1MachineElf 4y ago

I'm surprised this isn't an April Fools joke. Their proposed tune icon is dramatically less intuitive. It would be funny if it weren't for the fact that going against the traditional lock icon is a massive step back in security UI.