Re: Proposal: Marking HTTP As Non-Secure

> > Apologies to those of you who are about to get this more than once, due to the cross-posting. I'd like to get feedback from a wide variety of people: UA developers, web developers, and users. The canonical location for this proposal is: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure.
> > 

Thinking about this today I guess it depends on your web usage.

If what you do is mostly sensitive, I guess like using social media
then this may well be welcome. Of course the few social media sites or
highly used sites could easily be given special treatment in any case
so this point is mute.

If however you mainly do research of public domain content that has no
need to be encrypted or I expect most things on the internet have no
need to be encrypted then it seems more important to say to users:

Hey as this sites admin I have decided that this communication needs
to be secure therefore you should check the domain name is correct.

Encouraging users to submit their data to any site except http is simply
a really bad idea.

Having warnings during any submission on http is a good idea which
could also be extended to this connection is encrypted but do you
trust the domain "?.co" but warning about every http just seems to
weaken the prodding of users and not strengthen it as the norm.
Eventually getting to "Secure origins unmarked" seems like an originally
interesting idea has been twisted into a rediculous proposal that
simply misunderstands human behaviour?

-- 

KISSIS - Keep It Simple So It's Securable

-- 
You received this message because you are subscribed to the Google Groups "Security-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]