(4 votes, average: 3.50 out of 5)
Loading...Firefox and Chrome Now Warning About Insecure Login Pages
Warning about Insecure Login Pages is just the start…
This week, Google Chrome 56 and Mozilla Firefox 51 were both released. These updates bring a new warning about insecure login pages, which appear prominently in the address bar.
This is part of the industry-wide campaign to move away from HTTP, which is insecure, and leaves users’ online activity vulnerable to snooping, interception, modification, and much more.
Chrome 56 will show this warning for any password/credit card field loaded over HTTP.
This includes forms that post to HTTPS if the page itself is HTTP. Both the page itself, as well as the fields, need to be delivered over HTTPS to be properly secure and receive the “Secure” message and green padlock treatment. To help spread the word, Google has been sending messages via Search Console to warn admins if any unsecure fields are found on their websites.
In Firefox 51 the warning will be more subtle. The page will receive a “broken padlock” icon, which shows the padlock with a red strike through it. If you click the padlock, a message will tell users that their login information is at risk.
In Firefox 51 there will not be any warning for credit card fields, though Mozilla developers have previously said this feature is coming. Unfortunately, the ability to actively detect those fields has caused it to be delayed.
Chrome 56 for Android will also warn about password/credit card fields served over HTTP, however to accommodate for the smaller UI, only the “(i)” symbol will be shown in the address bar. Clicking the (i) will display additional text. The same behavior will also come to a future version of iOS, though when the update will be made has yet to be determined.
In-form warnings are coming to future versions for both browsers. These are warnings which will appear directly below the fields on the page. This will bring further attention to insecure fields and make it easier for users to see the warnings. Both mobile platforms will also get in-form warnings in future releases.
For any sites out there still using HTTP, make sure a migration to HTTPS is in your immediate plans. The encrypted web is coming, and the warnings are only going to get more severe. In fact, a Google engineer recently wrote “eventually, Chrome will show a Not Secure warning for all pages served over HTTP, regardless of whether or not the page contains sensitive input fields. Even if you adopt one of the more targeted resolutions above, you should plan to migrate your site to use HTTPS for all pages.”
I’m going to buy a MacPro. Will this solve the problem.
Unfortunately no.
Hello, how can I create a secure login when I visit a site that reads, ‘Login Not Secure’ , thank you.
S
Hi Scott,
If you own the website you need to install an SSL certificate and configure HTTPS for the site (or just the page if there are technical hurdles).
If you are just a visitor you can’t solve that problem on your own. You need to contact the site owner and tell them its important to you that they get HTTPS so you can securely login.
Where do you go too install an SSL certificate on yahoo add HTTPS?