Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Update on the Lock Icon

blog.chromium.org

Post reply on HN
Print view View original

21–30 of 169 posts

Re: An Update on the Lock Icon

#21

Post by runnerup »

p1mrx wrote: post #16

If you're using Chrome, right-click the URL bar and check "Always show full URLs", so you can see the https:// prefix like it's 1999. This also fixes a variety of UX problems with editing URLs. By the way, does anyone know of a good alternative to http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason.

Thank you. I searched and found a similar option in Safari settings but it doesn’t permanently show the protocol prefix. It also gets overridden on google searches where it just shows your search terms, not the URL.

Re: An Update on the Lock Icon

#22

Post by rzzzt »

p1mrx wrote: post #16

If you're using Chrome, right-click the URL bar and check "Always show full URLs", so you can see the https:// prefix like it's 1999. This also fixes a variety of UX problems with editing URLs. By the way, does anyone know of a good alternative to http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason.

It should always be possible to reach http://example.com (also .org and .net) over HTTP.

Re: An Update on the Lock Icon

#23

Post by p1mrx »

DiggyJohnson wrote: post #17
p1mrx wrote: post #16

If you're using Chrome, right-click the URL bar and check "Always show full URLs", so you can see the https:// prefix like it's 1999. This also fixes a variety of UX problems with editing URLs. By the way, does anyone know of a good alternative to http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason.

httpforever.com is my go to.

Nice. I see that https://httpforever.com/ exists with a 301 redirect to http://httpforever.com/, but that's probably good enough for most practical purposes.

Re: An Update on the Lock Icon

#24

Post by mholt »

For my masters thesis, I proposed replacing the security indicator with a risk indicator: "After HTTPS: Indicating Risk Instead of Security" - https://scholarsarchive.byu.edu/etd/7403/

Turns out there are lots of localized, privacy-preserving cues you can observe to determine whether a user may be at some level of risk, that doesn't involve a centralized blocklist or a boolean answer; and users really appreciated the "heads up".

I think a control panel like this is a good step forward after ubiquitous HTTPS. I also think user agents can do more to protect and warn users in ways that are less easily spoofed by malicious sites. Looking forward to seeing future developments!

Re: An Update on the Lock Icon

#25

Post by p1mrx »

rzzzt wrote: post #22
p1mrx wrote: post #16

If you're using Chrome, right-click the URL bar and check "Always show full URLs", so you can see the https:// prefix like it's 1999. This also fixes a variety of UX problems with editing URLs. By the way, does anyone know of a good alternative to http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason.

It should always be possible to reach http://example.com (also .org and .net) over HTTP.

Chrome redirects to https://example.com, so that's no bueno for testing http:// in your URL bar.

Edit: I'm running Chrome OS 113 beta. Maybe they changed something recently, to automatically use HTTPS unless prohibited by the server? This also happens in Guest mode with no extensions.

Re: An Update on the Lock Icon

#26

Post by notatoad »

p1mrx wrote: post #23
DiggyJohnson wrote: post #17

Earlier quoted context omitted.

httpforever.com is my go to.

Nice. I see that https://httpforever.com/ exists with a 301 redirect to http://httpforever.com/ , but that's probably good enough for most practical purposes.

that appears to also be what neverssl is doing - they support https only for the purposes of redirecting to a non-ssl domain

Re: An Update on the Lock Icon

#27

Post by post-it »

mattl wrote: post #13

Think of all the webpages that tell people to look for a padlock icon in their browser? All the books, all the training materials, videos, etc. This doesn't seem like a good idea at all.

They'll change. Maintaining backwards compatibility with third-party training material is the least-useful form of maintaining backwards compatibility.

Re: An Update on the Lock Icon

#28

Post by llimllib »

p1mrx wrote: post #16

If you're using Chrome, right-click the URL bar and check "Always show full URLs", so you can see the https:// prefix like it's 1999. This also fixes a variety of UX problems with editing URLs. By the way, does anyone know of a good alternative to http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason.

I used zombo.com for a long time before they finally, sadly, added https
Post reply on HN