Story image

Google gears up to mark all HTTP pages as 'not secure'

22 May 2018

From September 2018 Google will no longer display HTTPS pages as secure in its Chrome browser, in a move that further cements its position to make all websites secure by default.

Last week Chrome Security product manager Emily Schechter explained that internet users should expect that webpages are safe by default – and they will only be told when there’s an issue.

Previously, we posted a proposal to mark all HTTP pages as definitively “not secure” and remove secure indicators for HTTPS pages. HTTPS usage on the web has taken off as we’ve evolved Chrome security indicators. Later this year, we’ll be taking several more steps along this path,” Schechter says in the blog.

Google first announced its efforts in September 2016, and has since completed two phases towards making all pages HTTPS secure.

Currently Google Chrome marks all HTTP pages as not secure if they have password of credit card fields. It also shows HTTP pages as not secure when users enter data, and when users visit HTTP pages through incognito mode.

According to a blog from February 2018, more than 68% of Chrome traffic on Android and Windows is protected. 78% of traffic on Chrome OS and Mac is also protected. In July 2018 the third phase will mark all HTTP pages as not secure. In September 2018, all HTTPS will be marked as neutral rather than secure.

Schechter explains what these changes mean for users:

“Since we’ll soon start marking all HTTP pages as “not secure”, we’ll step towards removing Chrome’s positive security indicators so that the default unmarked state is secure. Chrome will roll this out over time, starting by removing the ‘Secure’ wording and HTTPS scheme in September 2018 (Chrome 69).”

In October 2018, HTTP will be marked in red as ‘not secure’.

“Previously, HTTP usage was too high to mark all HTTP pages with a strong red warning, but in October 2018 (Chrome 70), we’ll start showing the red “not secure” warning when users enter data on HTTP pages,” Schechter explains.

Google also says that HTTPS is now cheaper and easier than ever – some services even offer security certificates for free.

The company also points out that HTTP sites will continue to work and there are no plans to block them in Chrome; the only thing that will change is the security indicators.

“We hope these changes continue to pave the way for a web that’s easy to use safely, by default,” Schechter concludes.

Doctor Who fans: This one’s for you
Doctor Who: The Edge of Time is a new, VR gaming experience set to be released this September.
Are AI assistants teaching girls to be servants?
Have you ever interacted with a virtual assistant that has a female-based voice or look, and wondered whether there are implicitly harmful gender biases built into its code?
Hands-on review: Is the Apple Watch 4 worth the price?
Apple’s flagship wearable device, the Apple Watch, is generally touted as the gold standard for what wearables should be able to achieve today.
Who's watching you? 
With privacy an increasing concern amongst the public, users should be more aware than ever of what personal data companies hold.
Game review: Rage 2 (PC)
The similarities between Mad Max and Rage 2 are very apparent. The overall setting and design aesthetic are clearly inspired, if not from the Mad Max game, from the Mad Max movies.
Apple brings 8-core processors to MacBook Pro
The addition of 8th- and 9th-generation Intel Core processors will deliver 40% more performance than a 6-core Pro.
Hands-on review: Playing the long game with the The iPhone XR
The red XR is a rare case of having a phone that’s ‘too pretty to be covered’ - and it’s not hard to see why.
Hands-on review: MiniTool Power Data Recovery Software
I came across a wee gem of advice when researching the world of data recovery. As soon as you get that sinking feeling and realise you’ve lost a file, stop using your computer.