-1

Firstly I would like to mention that I got this news from a blog I have read in last few days. This is only, perhaps, a rumor. If this is true, does this mean that anyone using Google Chrome or apps from Google will be notified with these kind of 'threats'?

Perhaps will look something like this:

Error Code #65 : Web is infected with malicious code, and contains information by suspicious host provider. Please change your browser to hide this problem.

  1. So everyone must migrate and must use SSL certificate to establish verification of their host of web services and similar?

  2. Would SSL providers be richer than ever?

  3. Will more problems in SSL be found? (i.e. OpenSSL Heartbleed vulnerability)

Improve this question
2
  • 2
    Sounds like bogas. Stating that a every website is infected with malicious code is not right. I could see google maybe putting an exclamation icon in the address bar for http but that's about it. I could also see google partnering up with siteadvisor in the future and including a verification icon next to trusted websites on google search results
    – Tim Jonas
    Dec 19, 2014 at 10:36
  • A link to the source could help clarify specific words used.. but somehow I doubt that this is a reputable source to being with.
    – user2813274
    Dec 19, 2014 at 17:27

2 Answers 2

Reset to default
4

This sounds like a story that has grown massively in the telling. In August, Google announced that https websites would get a small boost in their search rankings compared to http sites. That's all; the http sites won't be marked or flagged as insecure.

On your point 2, SSL providers are likely to get poorer, not richer, because the EFF is launching a new SSL service that will provide basic certificates (good enough to get the Google boost) to everyone for free. So no one will have to pay to get the better search placement.

Also, note that your point 3 wouldn't be an issue. Universal use of https won't cause more problems; the worst case, with issues like Heartbleed, is that they're not quite as secure as they should be; they're certainly not less secure than http sites.

(Chrome will be marking SSL sites with certificates expiring after 1 January 2017 and that use the obsolete SHA-1 hash algorithm as insecure, and it's possible that someone has mixed up these two separate stories.)

Improve this answer
8

Yes, the Chrome team ("Google", if you wish) intends to "gradually change their UX to display non-secure origins as affirmatively non-secure" [1].

The exact implementation details are still a subject of discussion (see the "Proposal: Marking HTTP As Non-Secure" on the browser's mailing lists), and as such it is a bit premature to make any claims about how this will affect websites.

Because of the ongoing discussions, your 1st and 3rd question cannot be answered yet.
As for your second question,

Would SSL provider be richer than ever?

StartCom / StartSSL has been offering free SSL certificates for a while (for non-commercial websites). Recently several high-profile organizations together launched the Let's Encrypt initiative, which also provides free certificates for websites. Because of these viable free options, you are not forced to pay for a SSL certificate.

Improve this answer
2
  • "Non-secure" and "insecure" don't mean the same thing, and marking content as non-secure doesn't mean it's marked as insecure.
    – Mike Scott
    Dec 24, 2014 at 14:34
  • @MikeScott Your statement is not absolute as you state. The idea of showing similar indicators for broken https as http has been brought up during the discussions. Depending on how "non-secure" is displayed, it may or may not be perceived as insecure. E.g. the kind of users who use HTTPS Everywhere may equate non-secure http with insecure https. Those who barely know anything about https may not care either way.
    – Rob W
    Dec 24, 2014 at 14:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.