Chrome’s security team considers marking all HTTP pages as insecure

The Chromium Project’s security team has kicked off a debate on whether browser will mark all HTTP pages as insecure. “We … propose that user agents (UAs) gradually change their UX to display non-secure origins as affirmatively non-secure,” the team writes in this post. The post says the team’s goal “… is to more clearly display to users that HTTP provides no data security” because ““We all need data communication on the web to be secure (private, authenticated, untampered).”

The Chrome browser is generally considered the most secure Web browser, and it also tends to do the best in hacking competitions such as Pwn2Own. This is in part thanks to the solid security architecture of Chrome, and to its security engineers, who keep adopting strong security designs and policies. There’s always a compromise between security and flexibility/freedom to do something. Security is very much about reducing the attack vectors, which generally means reducing the freedom to use some features. Some of those security decisions can go too far sometimes, such as the decision to only allow Chrome extensions to be installed from the Chrome store, when there could have been alternative solutions that are not as restrictive. On Android, users are still allowed to sideload applications, just like Windows and Mac OS users can still install applications from outside the main store. This feature remains despite Android having a much bigger market share than Chrome, and with sideloaded Android apps being potentially much more damaging than Chrome extensions. Yet the security people in charge of Android have decided it’s a necessary freedom that needs to stay within the Android ecosystem.