Google Chrome to start marking HTTP connections as insecure

To push more websites to implement encryption and to better protect users, Google will start flagging plain HTTP connections as insecure in its popular Chrome browser.

The plan will go into effect in January with the release of Chrome 56 and will roll out in stages. Chrome 56 will display a “not secure” indicator before HTTP URLs in the browser’s address bar, but only for those web pages that contain password or credit card form fields.

Transmitting such sensitive information over HTTP is dangerous because the data can be intercepted by man-in-the-middle attackers on public wireless networks or via compromised routers, for example.

In later Chrome releases, the HTTP warnings will be further expanded. First, HTTP pages will be labeled as “not secure” when accessed in the browser’s privacy-oriented Incognito mode. Eventually, Chrome will show the warning for all HTTP pages and will switch the security indicator to the red triangle now used for broken HTTPS connections.

“Studies show that users do not perceive the lack of a ‘secure’ icon as a warning, but also that users become blind to warnings that occur too frequently,” said Emily Schechter, a member of the Chrome Security Team, in a blog post Thursday.

According to Google’s data, half of the pages loaded by Google Chrome users are now encrypted using HTTPS, and the adoption of this important security protocol is rising among websites.

Google’s other efforts to push encryption on the web include using HTTPS as a page ranking signal in its search engine. Even the online advertising industry has made significant progress in providing ads over HTTPS.

There’s little reason for websites not to implement encryption today. Due to improvements in browsers, web pages can now load significantly faster over HTTPS compared to HTTP, and thanks to services like CloudFlare or the Let’s Encrypt certificate authority, obtaining a Transport Layer Security certificate is now free.