It's actually not so complicated: obviously, there's nothing actionable for the user to do here. The message is for the user, but only indirectly: it's there to push developers into better practices. Your boss may not care about encryption or privacy, but definitely will care about hundreds of phone calls asking why they are warned that the form is insecure when they try to login.
With plenty of obscure pages accepting everything from passwords to credit card numbers on plain HTTP pages, this is important. There may not be someone browsing the page knowledgeable enough to catch this, but if any end user can know what they're doing is wrong, then it's much more likely it will be discovered.
While mostly not actionable directly for users, one thing a user can, and probably should, do is close the page, if they can.
So it's the online equivalent of plastering Warning: Contains chemicals known to the state of California to cause cancer all over everything from gas pumps to gerbils.
Yeah. Real useful.
No, it doesn't, unless your goal is to condition users to ignore yet another warning.
There are downsides to doing that, believe it or not.
"Nice open Internet you've got there, no gatekeepers. Be a shame if something were to happen to it."
Not everybody wants to use public keys to refer to everything - even if it is via QR codes.
That's just about every browser now. I think that full URLs are only available in Firefox, and only if you set `browser.urlbar.trimURLs` to `false` in about:config. Hiding URL information is a very bad trend.
But they are being careful. This rollout has been taking place slowly over the last two years, and continues to do so.
Changes are incremental to give developers a chance to adapt, and to prevent users from getting used to warnings.
HTTP/2 requires https. New APIs have started requiring https. And only forms with passwords or CC inputs will trigger security warnings. These are incremental steps.
I don't know why people think browser vendors haven't considered this stuff before.
Eventually vendors will start deprecating existing APIs to continue the migration towards requiring https. That will put more heat on developers, but only after they've ignored warnings for literal years.
But even the change announced today is only a UI update to the omnibar. It's hardly earth shattering.
HTTP worked unchanged for close to 3 decades. People started to rely on that. Now they are trying apply crowbars to force that out. This is myopic.
Not a full URL: example.com
Not the full URL: http://example.com (the page will load after completing the URL with a trailing slash)
This is the full URL for the homepage of example.com: http://example.com/
The grandma will not make better decision if you put in another dumb warning like this one https://i.imgur.com/rxmyWtF.png to waste more and more of my time when I enter my password on the same website over and over. I KNOW IT'S INSECURE, JUST STFU already.
I'm at the point where I will look to build my browsers from source after removing that shit (along with removing inability to add certificate exceptions for certain situations). Good thing they're open source.