Assuming you're sarcastic, but don't you think it's right to punish sites that don't use the best encryption strategies? I'd support three stages: 1) no encryp

Assuming you're sarcastic, but don't you think it's right to punish sites that don't use the best encryption strategies? I'd support three stages: 1) no encryption, 2) some/partial encryption, 3) "perfect" encryption. For the partial encryption, the browser would provide an explanation of exactly how it could be compromised. For the case where the encrypted version does not have perfect forward secrecy, it could explain that if the server is compromised, this session can also be decrypted. I don't think browsers should cover the banks' asses here. Edit (since I can't reply deeper): I thought you were being sarcastic since I consider a gradient to be a really horrible idea. I'd want something where the browser tells me something. I don't want to wonder whether the new browser version changed the gradients slightly or a site improved its encryption strategy. Clear symbols and language is a must.