Chrome now asks permission before insecure HTTP connections
Original title: Chrome puts insecure sites behind a permission prompt
Nearly 95% of desktop users see no HTTP warning in a week; intranet and local IPs are exempt.
Google enabled Chrome’s Always Use Secure Connections protection by default for all users, after first offering it to Enhanced Safe Browsing users. Chrome asks permission before an HTTP connection the first time a site is visited, then stays quiet unless the site is unused for at least two weeks. Warnings skip single-label hostnames and local addresses such as 192.168.0.1. Google says Chrome is the first browser to turn this on by default.
- Less than 1% of desktop users see three or more HTTP warnings in a week.
- Mobile warning rates are lower than desktop, Google says.
- The “Not Secure” badge appears only after data has already been exposed.
- Permission, once granted, is not repeated for two weeks of non-visits.
From the original article
2 min read at helpnetsecurity.com
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing’s Enhanced Protection mode. The vast majority of connections made by Chrome use HTTPS, according to Google.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.