Google Chrome: This week, the Google Chrome team will run an experiment to find solutions to a problem that has arisen in HTTPS, which Mozilla last year.
Specifically, the problem Google is trying to solve has to do with what’s called “mixed content.” Mixed content occurs when the original HTML of a web page is loaded over a secure HTTPS connection, but different resources like images, videos, code, and stylesheets are loaded over a secure HTTPS connection. It’s called mixed content because both HTTP and HTTPS are loaded to show the same page, even though the original request was secure over HTTPS. Modern browsers like Google Chrome display warnings about the type of content to indicate to the user that the page contains insecure resources.
The previous years, mixed content was a major problem for people building browsers and other organizations that adopted HTTPS. Mixed content errors, which are sometimes known for blocking users from gaining access to a website, have worried many site operators about migrating to HTTPS and many even feared they would lose revenue from traffic without benefiting from supporting HTTPS.
This week, Google engineers announced an experiment for Chrome that will automatically upgrade any mixed content to full HTTPS. Chrome will also do this by changing the URL of resources (such as images, videos, and code) from the HTTP version to the HTTPS alternative. If the same resource is present in an HTTPS link, then everything loads normally. If the resource is not present in an HTTPS alternative, then Chrome logs the error and runs one of several scripts configured for this experiment (details are given here). The reason for the experiment is so that Google engineers can get information about how websites will break if Chrome automatically updates mixed content sites to default HTTPS.
In the case where the percentage of broken links and sites is small, Google's engineers will seriously consider sending a feature of type «auto-update-to-HTTPS» to the main Chrome browser and will also adopt other security measures for a more secure web.
As for conducting the experiment, Google aims to test it on a portion of its Chrome Canary user base. As mentioned, Google is not the only company trying to provide solutions. Mozilla tried last year a similar mixed content automatic update in Firefox and found considerable «breakage» while Google's engineers hope they have already made some improvements. It should be emphasized that other similar experiments have been planned for the future.
