Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Update on the Lock Icon

blog.chromium.org

Post reply on HN
Print view View original

31–40 of 169 posts

Re: An Update on the Lock Icon

#31

Post by zeven7 »

p1mrx wrote: post #16

If you're using Chrome, right-click the URL bar and check "Always show full URLs", so you can see the https:// prefix like it's 1999. This also fixes a variety of UX problems with editing URLs. By the way, does anyone know of a good alternative to http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason.

For forever I used yahoo.com to login to a captive portal. I don't know why, but for some reason it worked for me when typing google.com, etc didn't work. Somehow I figured that out and stuck to it. I haven't done it in a while, though, not sure if it would still work.

Re: An Update on the Lock Icon

#32

Post by djur »

mattl wrote: post #13

Think of all the webpages that tell people to look for a padlock icon in their browser? All the books, all the training materials, videos, etc. This doesn't seem like a good idea at all.

That advice has been deprecated for years and has never been sufficient. The reverse is true now: the browser will warn about an insecure connection.

Re: An Update on the Lock Icon

#33

Post by p1mrx »

notatoad wrote: post #26
p1mrx wrote: post #23

Earlier quoted context omitted.

Nice. I see that https://httpforever.com/ exists with a 301 redirect to http://httpforever.com/ , but that's probably good enough for most practical purposes.

that appears to also be what neverssl is doing - they support https only for the purposes of redirecting to a non-ssl domain

Nope, when I go to neverssl.com, it ultimately lands on an HTTPS url, e.g. https://shinyquietbrightsong.neverssl.com/online/

Edit: I'm running Chrome OS 113 beta. Maybe they changed something recently, to automatically use HTTPS unless prohibited by the server? This also happens in Guest mode with no extensions.

Re: An Update on the Lock Icon

#34

Post by pavon »

dfabulich wrote: post #4

I approve of getting rid of the lock icon, showing only a broken lock for HTTP and no lock for HTTPS. It's always been weird to have site permissions settings revealed by clicking that lock. But the replacement icon looks really strange to me. They're calling it a "tune icon," but I've never seen a tune icon like this, with just two circles and two lines. Looks weird. I'm surprised that it fared well in the experimen…

Firefox currently uses the same icon to configure site permissions (microphone, location, etc). However, it is only displayed if you have granted permissions. You can see it here:

https://support.mozilla.org/en-US/kb/site-permissions-panel

Re: An Update on the Lock Icon

#35

Post by 0xffff2 »

notatoad wrote: post #26
p1mrx wrote: post #23

Earlier quoted context omitted.

Nice. I see that https://httpforever.com/ exists with a 301 redirect to http://httpforever.com/ , but that's probably good enough for most practical purposes.

that appears to also be what neverssl is doing - they support https only for the purposes of redirecting to a non-ssl domain

neverssl seems to be doing some weird thing where it uses Javascript to load a non-https link rather than an actual redirect. I can't for the life of me guess why that would be better than a simple 301 redirect.

Re: An Update on the Lock Icon

#36

Post by shadowgovt »

mattl wrote: post #13

Think of all the webpages that tell people to look for a padlock icon in their browser? All the books, all the training materials, videos, etc. This doesn't seem like a good idea at all.

This is forever the problem with documentation: it checkpoints a description of a system at a point in time.

You can make an extremely valid similar argument regarding C++ tutorials written in 1995, but the end-response is the same: "Update your sources, learn the new thing, and most importantly don't assume anything computer-related that is more than 5 years out of date is relevant, especially for something Internet-related."

Re: An Update on the Lock Icon

#37

Post by 0xffff2 »

p1mrx wrote: post #33
notatoad wrote: post #26

Earlier quoted context omitted.

that appears to also be what neverssl is doing - they support https only for the purposes of redirecting to a non-ssl domain

Nope, when I go to neverssl.com, it ultimately lands on an HTTPS url, e.g. https://shinyquietbrightsong.neverssl.com/online/ Edit: I'm running Chrome OS 113 beta. Maybe they changed something recently, to automatically use HTTPS unless prohibited by the server? This also happens in Guest mode with no extensions.

Do you have HTTPS Everywhere or a similar plugin installed? If you look at the page source, it's "redirecting" in a script with this line:

    window.location.href = 'http://' + prefix + '.neverssl.com/online'
I get a plain http page on Firefox/Ubuntu.

Re: An Update on the Lock Icon

#38

Post by amluto »

p1mrx wrote: post #16

If you're using Chrome, right-click the URL bar and check "Always show full URLs", so you can see the https:// prefix like it's 1999. This also fixes a variety of UX problems with editing URLs. By the way, does anyone know of a good alternative to http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason.

I use example.org. An explicit http://example.org does the trick when needed.

Re: An Update on the Lock Icon

#39

Post by xPaw »

This is a good move for the secure-by-default move.

In The Lounge IRC client, we've also opted to this approach years ago, where secure connections show no icon, and insecure connections show an insecure icon.

Re: An Update on the Lock Icon

#40

Post by mattl »

shadowgovt wrote: post #36
mattl wrote: post #13

Think of all the webpages that tell people to look for a padlock icon in their browser? All the books, all the training materials, videos, etc. This doesn't seem like a good idea at all.

This is forever the problem with documentation: it checkpoints a description of a system at a point in time. You can make an extremely valid similar argument regarding C++ tutorials written in 1995, but the end-response is the same: "Update your sources, learn the new thing, and most importantly don't assume anything computer-related that is more than 5 years out of date is relevant, especially for something Internet…

Okay but unless other browsers make the same change now you have two sets of information and now users need to know their underlying browser's engine too?
Post reply on HN