> We know that people do not generally perceive the absence of a warning sign. Yet the only situation in which web browsers are guaranteed not to warn users is

> We know that people do not generally perceive the absence of a warning sign. Yet the only situation in which web browsers are guaranteed not to warn users is precisely when there is no chance of security: when the origin is transported via HTTP. That is a very strong point. User perception of the browsers' current UX treatments of the various security scenarios poorly represents the true level of security. An insecure HTTP site (no warnings) looks safer than an HTTPS site which happens to reference a single non-HTTPS image (mixed content warning). The absence of a warning for the HTTP site is not fair, because despite the mixed content, data submitted in a web form to the HTTPS site is still encrypted, yet the UX treatment affords it less trust. Separately, how should Extended Validation (EV) certificates fit into this plan? Especially after the final proposed transition phase, T3: Secure origins unmarked. Personally, I think EV certs have become kind of a racket in the CA industry. But they exist nonetheless, and we should push for more consistent browser treatment of site security in general, including consistent treatment of EV certs.