3 ms·

Honestly, I'd prefer a heuristic that could determine whether https was significant on the current URL. Are there submitted values, cookies of importance, get p

Honestly, I'd prefer a heuristic that could determine whether https was significant on the current URL. Are there submitted values, cookies of importance, get parameters? There are a lot of reasons https is important and there are a lot of places where it's totally not important. If you draw people's attention to something that isn't seriously important, then those times when the whole screen sends a warning you go, "oh well, I had that red warning going all along and it didn't matter, so why do I care?" I am saying that by pushing a warning where it's not necessary, you diminish the value of any warning.

briansmith 12y ago
> There are a lot of places where it's totally not important. See my other replies on this page for some reasons why I think there are no pages where HTTPS is not important. I agree with you regarding the UI issues and the potential to generate apathy by crying wolf. That's why I think that the specifics of the linked-to proposal won't work. But, I think the general idea is worth investigating. It just requires some user research. Also, the fact that browsers support a non-HTTPS mode at all is really the bigger UI issue. Imagine if HTTPS was the only option. The biggest UI security problems would instantly vanish! That's a big reason why a lot of people are actively working so hard on finding ways to make HTTPS work for everybody on every site.