I hope they do this for CC numbers too, because I know of a website I had to use that passed your Name, address, CC number, CC exp, amount; the whole shebang over plain ol' http to do a payment shudder.
Chrome 56 will mark HTTP pages with password fields as non-secure
41–50 of 419 posts
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#42It should just label HTTP pages as "not secure", full stop. Because they aren't secure. Or at least, any page with a form. Never mind if it's a password field or not.
"Studies show [...] that users become blind to warnings that occur too frequently." So right now it would be counterproductive to mark all http pages as "not secure". But it's the long-term goal.
The majority of the big sites that people use (Google, GMail, Youtube, Facebook, Reddit, NYT, WaPo, etc.) are already being served using HTTPS. I think if a couple of HTTP sites an average user still browses start showing these warnings they will notice them. And what matters, the owners of those websites will notice them and will ask their "IT guy" hey "why our website is marked as insecure? I want a green lock like Gmail has".
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#43Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"
It would be better if form is served up via HTTP it gets marked as insecure.
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#44Earlier quoted context omitted.
Don't you need to use type = "password" to get the -for-every-character treatment? I suppose you could implement your own (e.g. type = "text" with an onKeyDown listener that cached each keystroke and inserted a into the field), but that sounds like a terrible solution in so many ways. I would think the laziest possible way to workaround this would be to use a CDN like Cloudflare to proxy all traffic to your site. Loo…
That's literally what my router's login page does. It is a text box but has JavaScript which converts each non-* character into a * character and stores the actual value in a JS variable. Why? They added a "Show Password" radio and I guess they figured this hack made more sense than simply using JS to update the DOM to turn it from a type password to a type text.
IIRC, changing the 'type' of an input doesn't (or, at least, didn't) work in some browsers.
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#45I'd like to see this with Adobe Flash and third party scripts. (Pandora!)
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#46Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"
The Law of Unintended Consequences at its best
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#47Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"
Don't you need to use type = "password" to get the -for-every-character treatment? I suppose you could implement your own (e.g. type = "text" with an onKeyDown listener that cached each keystroke and inserted a into the field), but that sounds like a terrible solution in so many ways. I would think the laziest possible way to workaround this would be to use a CDN like Cloudflare to proxy all traffic to your site. Loo…
A few solutions:
- Create a font such that every character shows up as a * and use it for a text input.
- make the input field use white text on a white background using a fixed-width font, monitor length, and display the correct number of *'s above it using a div.
- implement the text box ground up from scratch using div's and JS, like google docs does.
- implement a HTTPS password field in an iframe and communicate with it over post messages.
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#48Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"
I laughed out loud. Then started crying.
Sigh. Our industry in a nutshell.