4 ms·

Good point. There is potential for this to do more harm than good. The handling of insecure sites is very plain and non-alarming. The handling of https sites us

by jfoster 12y ago

Good point. There is potential for this to do more harm than good. The handling of insecure sites is very plain and non-alarming. The handling of https sites using SHA-1 is red & scary-looking. If the Chrome warning were clearer on what is wrong and what should be done to remedy it, there would be less risk of that happening.

josteink 12y ago
> If the Chrome warning were clearer on what is wrong and what should be done to remedy it, You mean if Chrome, like MSIE in the old days, had huge dialog windows with lots of text, which users learned to instinctively ignore and click away... This would somehow play out differently now than it did back then. It wont. I'm guessing lots of "lazy"/over-burdoned sysadmins will just disable HTTPS to make the Chrome-users shut up, and then he will forget about it, leaving the site HTTP-only.
- jasonmp85 12y ago
  And when Google starts penalizing their page in rankings because it's plaintext only? The sysadmins will hear about that from their bosses when visits drop.
Someone1234 12y ago
I actually agree. They should just yellow bar all the SHA-1 stuff. But will such a subtle approach force CAs to do the right thing? Unfortunately people have been bugging them for a long time, and it seems only a metaphorical gun to their heads has had any effect. I agree that HTTP being white and "happy" and SHA-1 giving the "DANGER WILL ROBINSON" scare alert, is inconsistent/wrong. That's more a HTTP issue however rather than a SHA-1 one (i.e. HTTP needs to be marked insecure).
gsnedders 12y ago
Google have done a lot of studies to try and reduce the number of click-throughs of TLS warnings, especially when it comes down to the wording of the message.
- jfoster 12y ago
  I don't mean they should present the message to all users. Currently, even if you go into the certificate details without being prompted, there is nothing there saying anything to the effect of "SHA-1 is insecure; if you are the webmaster, get this certificate issued with SHA-2"

by jfoster 12y ago

josteink 12y ago

> If the Chrome warning were clearer on what is wrong and what should be done to remedy it, You mean if Chrome, like MSIE in the old days, had huge dialog windows with lots of text, which users learned to instinctively ignore and click away... This would somehow play out differently now than it did back then. It wont. I'm guessing lots of "lazy"/over-burdoned sysadmins will just disable HTTPS to make the Chrome-users shut up, and then he will forget about it, leaving the site HTTP-only.

jasonmp85 12y ago
And when Google starts penalizing their page in rankings because it's plaintext only? The sysadmins will hear about that from their bosses when visits drop.

Someone1234 12y ago

I actually agree. They should just yellow bar all the SHA-1 stuff. But will such a subtle approach force CAs to do the right thing? Unfortunately people have been bugging them for a long time, and it seems only a metaphorical gun to their heads has had any effect. I agree that HTTP being white and "happy" and SHA-1 giving the "DANGER WILL ROBINSON" scare alert, is inconsistent/wrong. That's more a HTTP issue however rather than a SHA-1 one (i.e. HTTP needs to be marked insecure).

gsnedders 12y ago

Google have done a lot of studies to try and reduce the number of click-throughs of TLS warnings, especially when it comes down to the wording of the message.

jfoster 12y ago
I don't mean they should present the message to all users. Currently, even if you go into the certificate details without being prompted, there is nothing there saying anything to the effect of "SHA-1 is insecure; if you are the webmaster, get this certificate issued with SHA-2"