Hacker News Reader

Comment by peterwwillis | Hacker News Reader

> Users should expect that the web is safe by default

I don't expect this of anything else in my life. Why in the world would I expect the web to be safe?

To be clear: the only thing this is assuring is that your connection is secure. Your content may not be. Hell, the web server may not be. There's no way a browser can know these things. And they're going to assure the user they're secure by default?

Lots of phishing sites use valid connections to trick you into giving your SSN, credit card, and other data. This is not safe or secure. But the browser is telling me it is.

View on HN

You expect text messages to be intercepted in transit? You expect people to steal things out of your checked luggage? You expect your credit card number to be stolen whenever you give it to a restaurant to swipe?

All of these things happen with some frequency, sure, but I personally expect that they don't, which is why I'm disappointed and upset when they do happen.

And the fact that the browser can't assure any other security besides transport security on its end is exactly why it shouldn't be displaying an indicator saying "Secure," when all it means is "In this particular way, it is not insecure; for everything else I have no idea." If it knows it's insecure in a particular way, it should display a warning or possibly an error. If it doesn't, it's meaningless to claim "Secure." That's how the rest of the world works: the State Department gives you warnings about high-risk travel areas, but it doesn't say that any place is safe and crimes won't happen to you there.

Guess I'm the only person who never sends sensitive information by text, never checks valuables into baggage, and never hands my credit card to the person serving me? (Ok, this last one has become way less important since the rollout of Chip & PIN).

Sure, there are people who do that, and there are people who do all their web browsing in Tor. Such people are important and there should be tools (like Tor Browser) built for them, but they're also very much not the target audience of the default case. Chrome is a mass-market browser, not a browser built for people with specific uncommon security needs.

(What do you do at restaurants - pay with cash? Insist on walking up to the PoS device?)

Actually the target position is that https _won't_ be marked as "secure", but rather than http will be marked as "not secure". Can't really argue with that.

Oh I'm not arguing with that part, that's a good development. But that's "assume the web is just the web", not "assume the web is secure by default". The latter is a dangerous idea.

I take this to be a aspirational statement, not a descriptive one. Google is not saying the web is currently safe by default, but rather that it is their goal to make browsing a safe experience by default.

A place or thing can be considered "safe" without being absolutely safe.

Reply on news.ycombinator.com