Ideally, we should be using DANE or some other kind of signed broadcasted info. Telling the user what happened is just a very good workaround (that will stay useful even if we change to DANE).
Right, I think his point there was, the ecosystem has to make many changes to ensure the links are the "secure version": we create URLs with https, make browser changes to redirect (HSTS), use redirect in server software, etc.
With "just" HTTP, all URLs are uniform, but the protocol is modified upon connection to 'upgrade' the link to something secure, instead. HSTS maybe wouldn't be needed (or would take a slightly different form).
Maybe browsers should stop with that idiocy then.
Browser developers aren't in a position to retrain users to their preferred ideology. Their job is to find ways to make the web easier to use.
And in fact they have: green URL bars, padlocks etc. – these are UI metaphors that do a much better job than a one-letter change in a cryptic initialism from the 70'ies.
Even holier-than-thou professionals should profit from this: a green URL actually means the connection is protected, whereas it's quite easy to use https without actually using encryption or at least using completely insecure ciphers.
First, browsers added a padlock icon on the left for https:// sites. Then, phishing sites, and even banking websites, started using a padlock for their favicon, and users couldn't tell the difference. So it was abandoned.
Then, the whole background of the URL bar was turned a sort of gold-yellow color when the site was secure. It was like this: http://www.facebookloginhut.com/wp-content/uploads/2010/07/s...
Then that effect was removed, I think it scared some users, or they didn't know to look for it, I don't know.
Now, favicons are never shown in the URL bar so a padlock favicon can no longer mislead. Some browser started hiding "http://", some started coloring "https://". (Now many do both.) The extended-validation green pill thing was added. It's harder than ever to allow a self-signed cert when you're using a service you set up yourself on your LAN.
Apparently there are more changes planned, every year or so. "users" have no chance of keeping this stuff straight, only "experts" like me and you do.
I wouldn't worry as much about how to get people to notice security, browser vendors are on the right track by popping up giant notices for insecure sites and sites with malware.
They just need to extend the "untrusted download" concept from operating systems to email where you could have "untrusted link" warnings in your browser instead. "Are you sure you want to visit paypal.28753272.server? You really shouldn't trust this link..."
They don't understand that when someone says "go to google.com" that something isn't wrong when the url bar says "https://google.com". They think they something is broken.
Heck, Safari now be default doesn't even show you the path, they just show the domain, because once people get to foo.com they don't even understand about the paths, nor care.
While I agree, I do not believe this is an appropriate excuse for ignorance (I am not accusing you of anything, just criticizing the viewpoint itself).
Computers are part of life. People know about antibiotics, vaccine, stem cells, black holes, and they know atomic radiation causes cancer and the same material can be used for atomic bombs, about wavelengths, and certain ones (UV) cause cancer by breaking DNA, etc.
But, not technology? How is there such a well-formed ignorance when it comes to technology? It's fed to us by the media too, who cite "computer glitches"[1,2,3] when something goes wrong, or when there is a breach of the system and all credentials stolen.
And, not understanding URLs leads to susceptibility to information being stolen from phishing attacks. Whose "fault" is there here?
[1] "Glitch" http://money.cnn.com/2013/12/26/news/companies/delta-ticket-...
[2] "Something broke" https://www.theguardian.com/technology/2016/feb/08/departmen...
[3] "Glitch" http://www.nbcnews.com/video/nightly-news/48088061
You don't need to learn about the Dewey decimal system when reading books, either. For the same reason - it's helpful for finding things, it allows you to classify books, and it doesn't matter at all since there are better ways to find books now.
> A proposal then is to do HTTPS everywhere in the sense of the protocol but not the URI prefix. A browser gives the secure-looking user interface message, such as displaying the server certificate holder name above the document, only when the document has been fetched in an authenticated over an encrypted channel. This can be done by upgrading the HTTP to include TLS in real time, or in future cases by just trying encrypted version first.
He also states
> It is the user's task to ensure that their interactions are secure.
meaning, users are trained to look for the 's' but browsers are hiding the URI prefix, making this difficult.
[1] https://www.w3.org/DesignIssues/Security-NotTheS.html