Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

FWIW, "the padlock is enough" is quite the opposite of Google's position:

https://blog.chromium.org/2018/05/evolving-chromes-security-...

and in fact one of the main reasons is that use of HTTPS is far too little information for the browser to affirmatively indicate "This site is secure and trustworthy." So they are planning to get rid of the padlock. (Use of HTTP is enough for the browser to affirmatively say it's insecure, though.)

So I think Google understands that one of the consequences of pervasive HTTPS is that the padlock is at best meaningless and at worst misleading, as we saw here.



I can agree firsthand, people think a site, any site, is safe because of the padlock... :facepalm:




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: