Chrome 56, due out in January 2017, will begin marking HTTP pages containing sensitive content, such as passwords or payment forms, as insecure, Google has announced.
Google 's ultimate goal is to mark all HTTP pages with a red icon specific to broken HTTPS connections, but the company plans to do this in several stages.
The first stage, as Emily Schechter from the Chrome Security Team explains today, begins next January, when the browser will start to preface the phrase “Not secure” before the page’s URL.
“In future releases, we will continue to expand HTTP warnings, for example by marking HTTP pages as “Not secure” in incognito mode, where users have higher expectations for their privacy,” explains . “Eventually, we plan to mark all HTTP pages as not secure and change the HTTP security indicator to a red triangle that we use for broken HTTPS.”
Current Chrome versions do not use any kind of indicator to highlight to the user that they are browsing through an insecure HTTP connection, which transmits data in plain text.
HTTP connections are considered insecure in the eyes of many security and business experts, but there are many users who don't pay much attention to whether the website they are on uses HTTP or HTTPS.
This key decision by Google comes to educate users about the dangers of HTTP connections that are prone to MITM attacks, among many things.
Data sent over HTTP connections, such as passwords or payment details, can easily be intercepted by a person on the same network.
Google is pushing websites to use HTTPS. Mozilla is doing the same, through its Let's Encrypt project, which provides free TSL certificates for website owners so they can implement HTTPS for their services.
Google says that according to Chrome telemetry, about half of the web pages loaded in its browser every day are over HTTPS.
