Hacker News Reader

Comment by lucideer | Hacker News Reader

The biggest problem here is not that the green lock is being eliminated, but rather that HTTP pages will show a low-contrast grey message unless and until you type into an input.

By default, if you're not typing in a form, Chrome will show no major eye-catching colour-differentiation between HTTP and HTTPS. That's a major regression in user security.

View on HN

I believe you're mistaken, conflating two different steps. There's still going to be a lock for HTTPS while the "Not Secure" message doesn't turn red for HTTP until you type in a text box.

The post indicates that by the time the lock disappears ("eventually"), then all HTTP sites will be marked as not secure in red. In the meantime it's removing the "Secure" text with the lock and HTTP sites will get their "Not Secure" turned red when you type in a text field. Those seem like fine steps.

> That's a major regression in user security.

Turning red is more functionality than today, not less.

What the poster you're replying to is saying is that the reduction of contrast between secure and not (prior to anything being typed into the page) is the reduction in functionality.

That is, there is now nothing eye-catchingly different between HTTP and non-HTTPs aside from a small monochrome marker; I think OP's concern is that that will get lost in people's vision next to the URL — they won't notice it. (And I somewhat agree w/ that.)

That's exactly the intent. Too many false positives will teach people to ignore the red marker, so putting it in place before the web catches up would be counterproductive.

> Turning red is more functionality than today, not less.

Firstly, I didn't say it was a regression in functionality, just a regression in security (due to the loss of contrast by removing the green).

Secondly, I actually did think the red was currently in place. I'm not a Chrome user, so it seems surprising to me that there is no warning currently in Chrome for entering data into insecure forms!? Firefox currently shows a red slash in the URL and an additional popup on the form input element itself which appears on focus rather than only after you've actually entered text. The Chrome team has such a good reputation for improving security on the web, so it seems bizarre to me they'd be behind on something so simple (and also not even attempting to catch up).

It's not easy to explain to your parents either. "Don't look for the padlock any more, just look for a Not Secure warning... which may not appear until AFTER you put in your credit card details... at which point it's not really helped you at all has it. Huh. I have no idea what Google was thinking here. Better call the bank and cancel your credit card every time Not Secure pops up."

To be fair, the "Not Secure" message is always there—it only changes color to red once you start typing into a form field. I do think it should be red by default, because the gray is not obvious enough, but I don't think it's necessarily any harder to explain than the green padlock.

It's kind of a weird how it works. Users will be looking at the field they are typing on (or even the keyboard for some users). Then they'll look down for the next field and so on until they reach submit. I think users will often miss the color change entirely.

I think it'd make more sense to just make it red if there is any input options on the page at all.

Firefox shows an insecure warning in the insecure form field itself so the user will see it.

An attacker could probably emulate a form in JavaScript without using any actual input fields.

Displaying the indicator on user input seems much more difficult to bypass.

"If it says Not Secure, it's definitely not secure. If it doesn't say that, it's probably not secure anyway."

No, as of chrome 68, http will be marked as not secure without waiting for any user interaction at all. The change for http pages outlined in this post is to upgrade that from the grey info message to a red warning.

Reply on news.ycombinator.com