Chrome puts insecure sites behind a permission prompt
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing’s Enhanced Protection mode.
The vast majority of connections made by Chrome use HTTPS, according to Google. However, unprotected HTTP traffic can expose users to malware, phishing, eavesdropping and other threats. Any HTTP request gives attackers an opportunity to inject malicious content into the browsing experience, often without users realizing they are at risk.
Why “Not Secure” warnings fall short
Chrome already labels insecure pages as “Not Secure,” but the company says these passive warnings have significant limitations. Users may overlook them, and browsers cannot display the badge during short-lived HTTP traffic, such as redirects. Most critically, the badge appears only after the connection and users’ data have already been exposed.
“By asking users to permit Chrome to proceed before the connection occurs, Chrome gives users the tools they need to stay safe,” Eric Trouton, Product Manager for Chrome, and Joe DeBlasio, Engineering Manager for Chrome, explained.
The “Always Use Secure Connections” setting warns users before accessing a site without HTTPS (Source: Google)
Google acknowledges that HTTPS adoption is not universal and that some users still need to access HTTP sites regularly. Chrome will ask users to approve HTTP access the first time they visit a site. Once permission is granted, the browser will not warn again unless the user has gone at least two weeks without visiting that site.
Exceptions for local sites and devices
By default, the warnings will not appear for sites that cannot obtain a publicly trusted HTTPS certificate. Examples include single-label hostnames such as intranet/ and local IP addresses such as 192.168.0.1, which are often used to configure home Wi-Fi routers and similar devices.
These hosts are typically at lower risk because an attacker would need to be on the user’s local network to tamper with the traffic.
The company says widespread HTTPS adoption has made it possible to enable the warnings without overwhelming users with frequent prompts.
Early rollout data shows that “nearly 95% of Chrome users on Desktop don’t see any HTTP warnings in a given week, with less than 1% seeing 3 or more,” Trouton and DeBlasio wrote.
“Warning rates on mobile are even lower, and as more sites adopt HTTPS for their sites, we expect warning rates to keep dropping,” they added.
Google says Chrome is the first browser to enable this protection by default for all users and hopes other browsers will follow.
