Google wants to kill the unencrypted internet, and will soon flag two thirds of the web as “unsafe.”
Google wants everything on the web to be travelling across a secure channel. That’s why in the future your Chrome browser will flag unencrypted websites as insecure, displaying a red “x” over a padlock in the URL bar.
With this upcoming change in Chrome, Google makes it clear that the web of the future should all be encrypted, and all sites should be served over HTTPS, which is essentially a secure layer on top of the usual HTTP web protocol. Several companies and organisations have been pushing for more encrypted sites as part of a campaign to “Encrypt All Websites,” which consists of promoting more websites to abandon the traditional, less secure HTTP protocol and adopt the more secure HTTPS.
Currently, Chrome displays only an icon of a white page when the website you’re accessing is not secured with HTTPS, a green locked padlock when it is, as well as a padlock with a red “x” on it when there’s something wrong with the HTTPS page the user is trying to access. The change will draw even more attention to the sites that are potentially insecure.
“The goal of this proposal is to more clearly display to users that HTTP provides no data security.”
The internet giant quietly announced this transition back in 2014, when one of it’s members of the Chrome Security Team sent out a proposal to mark all HTTP websites as “non-secure.”
“The goal of this proposal is to more clearly display to users that HTTP provides no data security,” Google’s Chris Palmer wrote.
During a presentation at the Usenix Enigma security conference in San Francisco, an engineer from security firm CloudFlare showed how this looks like today when the user enables a special feature in Chrome’s settings, and presumably how it might look like in the future if it’s enabled by default. (You can see the little red “x” on the padlock in the URL bar.)
Parisa Tabriz, who manages Google’s security engineering team, tweeted that Google’s intention is to “call out” HTTP for what it is: “UNSAFE.”
The consensus being that on every website served over HTTP the data exchanged between the site’s server and the user is in the clear, meaning anyone with the ability to snoop on the connection, be it a hacker at a coffee shop or a repressive government, could steal passwords, private messages, or other sensitive information.
But HTTPS doesn’t just protect user data, it also ensures that the user is really connecting to the right site and not an imposter one. This is important because setting up a fake version of a website users normally trust is a favourite tactic of hackers and malicious 3rd party. HTTPS also ensures that a malicious third party can’t hijack the connection and insert malware or censor information.
Google’s intention is to “call out” HTTP for what it is: “UNSAFE.” Tech and privacy experts applauded Google’s plan.
Google already signalled its preference for HTTPS websites when it called for HTTPS to be “everywhere” on the web during its 2014 I/O conference, and when it announced that it would rank encrypted sites higher in search results. The internet giant isn’t the only big player on the web pushing for more HTTPS. Mozilla and Apple have both indicated that they want more web encryption. And even governments including the US have taken steps in that direction, requiring all .gov websites to be HTTPS by default.