Google will mark non-encrypted websites with a scarlet letter

Chrome can mark unencrypted sites with a red "X," but only as an optional feature for now.
  • Jared Newman (PC World (US online))
  • 29 January, 2016 04:52

Google Chrome users may now enable a mark of shame when visiting websites that don’t use HTTPS encryption.

As Motherboard reports, these sites will have a red “X” and gray padlock icon next on the left side of the address bar. Google currently uses this icon to flag instances where encryption doesn’t work properly, but may also expand it to unencrypted HTTP sites.

For now, the icon is available as an optional flag in Chrome. Users can enable it by visiting chrome://flags, scrolling to “mark non-secure as,” and choosing “mark non-secure origins as non-secure.” An unnamed Google employee told Motherboard that the company will the goal is to make this option default “someday, hopefully.”

What’s the holdup? As one developer noted when Chrome’s Security Team first proposed the idea in 2014, in many cases getting an HTTPS certificate isn’t free. Hitting HTTP sites with a scarlet letter might not go over well with webmasters, especially for smaller sites.

Still, many major sites now use HTTPS, and Google has been factoring HTTPS into its search rankings (albeit as a minor ranking signal) since 2014.

Why this matters: With HTTPS, data travelling to and from the web browser is better-protected against surveillance and hijacking of sensitive data. The only drawback, aside from the effort required by webmasters to implement it, is that it’s a little bit slower than non-encrypted HTTP connections. Although Google has advocated the use of HTTPS for several years, the search giant has tried to avoid being too heavy-handed. The new icon is another way to nudge more sites to make website encryption the norm.