I see a big danger in the current trend. Expecting everyone having a free „secure“ certificate and being in requirement to enable HTTPS it will result in nothing won. DV certificates (similar to DANE) do finally say absolute nothing about the website operator. They ensure encryption, so I can then be phished, be scammed, … encrypted. Big advantage!^^ Pushing real validation (e.g. EV with green adressbar and validated details by an independent third party, no breakable, spoofable automatism) vs. no validation is much more important and should be focussed on. However, this „change“ could come with marking HTTP as Non-Secure, but just stating HTTPS as secure is the completely wrong sign and will result in more confusion and loosing any trust in any kind of browser padlocks than before. Just a proposal: Mark HTTP as Non-Secure (similar to self-signed) e.g. with a red padlock or sth. similar. Mark HTTPS as Secure (and only secure in favor of encrypted) e.g. with a yellow padlock or sth. similar Mark HTTPS with Extended Validation (encrypted and validated) as it is with a green padlock or sth. similar This would be a good road for more security on the web.
Received on Monday, 15 December 2014 08:56:42 UTC