{"id":598,"date":"2017-07-29T11:33:14","date_gmt":"2017-07-29T19:33:14","guid":{"rendered":"http:\/\/unmitigatedrisk.com\/?p=598"},"modified":"2017-07-29T11:39:58","modified_gmt":"2017-07-29T19:39:58","slug":"positive-trust-indicators-and-ssl","status":"publish","type":"post","link":"https:\/\/unmitigatedrisk.com\/?p=598","title":{"rendered":"Positive Trust Indicators and SSL"},"content":{"rendered":"

[Full disclosure I work at Google, I do not speak for the Chrome team, and more generically am not speaking for my employer in this or any of my posts here]<\/strong><\/em><\/p>\n

Recently Melih did a blog post<\/a>\u00a0on the topic of browser trust indicators. In this <\/span>post he makes the argument that DV certificates should not receive any positive indicator in the browser user interface.<\/span><\/p>\n

I agree with him, just not for the same reasons. Positive trust indicators largely do not work and usability studies prove that is true. Browsers introduced the \u201clock\u201d user interface indicator as part of a set of incentives and initiatives intending to encourage site operators to adopt SSL. <\/span><\/p>\n

What is important is that these efforts to encrypt the web are actually working, over half the web is now encrypted<\/a> and more importantly the adoption rate is demonstrating hockey stick growth.<\/span><\/p>\n

As a result, in 2014 Chrome started down the path of deprecating positive trust indicators all together<\/a>. In-fact today Chrome already marks HTTP pages as \u201cNot secure\u201d if they have password or credit card fields.<\/a><\/span><\/p>\n

The eventual goal being able to mark all HTTP pages as insecure but for this to happen SSL adoption needs to be much higher, I suspect browsers will want to see adoption in the 90% to 95% range before they are willing to make this change. <\/span><\/p>\n

This is relevant in this case because if all pages are encrypted what value does a positive trust indicator have? None. This means that when all HTTP pages get marked \u201cNot secure\u201d we will probably see the lock icon disappear.<\/span><\/p>\n

So, as I said, I agree with Mehli, the \u201cSecure\u201d indicator should go away but so should the lock, the question is not if, but when. <\/span><\/p>\n

But what does that mean for EV trust indicators? I am a member of a small group, a group that thinks that EV certificates can provide value. With that said today EV certificates have some major shortcomings wich significantly limit their value, some of which include:<\/span><\/p>\n