{"id":1925,"date":"2016-05-23T03:30:49","date_gmt":"2016-05-23T07:30:49","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=1925"},"modified":"2018-10-01T07:43:06","modified_gmt":"2018-10-01T11:43:06","slug":"google-chrome-does-away-with-the-yellow-caution-triangle","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/google-chrome-does-away-with-the-yellow-caution-triangle\/","title":{"rendered":"Google Chrome Does Away With the Yellow Caution Triangle"},"content":{"rendered":"

Today marks the release of Google Chrome Version 46, which contains a notable change in Chrome\u2019s SSL UI<\/h2>\n

Google Chrome shows a security indicator to the left of the URL in the address bar \u2013 that\u2019s where the Green Padlock and Green Address Bar live. There were also three other states that the indicator could take: a white \u201cPage\u201d icon used for HTTP connections, a lock with a yellow \u201ccaution triangle\u201d for HTTPs with minor errors, or a lock with a red \u201cX\u201d for HTTPs with broken (insecure) configurations.<\/p>\n

\"GoogleSecurity\"<\/p>\n

Figure 1. Google Chrome’s Security Blog showing the “Green Padlock”, used for sites with proper SSL configurations.<\/p>\n

That meant there were four total states of UI for a website\u2019s SSL configuration. Today that has been reduced to three; the lock with yellow \u201ccaution triangle\u201d was removed. This icon was primarily seen when a website had \u201cMixed Content\u201d \u2013 this means they were using HTTPs but some of the resources on the page were loaded over HTTP \u2013 a mix of both secure and insecure origins, hence the name. You may also have seen this icon for websites using a SHA1-signed certificate expiring in 2016.<\/p>\n

The icons and their display criteria are best shown below. This image came from Google\u2019s Security Blog<\/a> describing today\u2019s changes:<\/p>\n

\"chrome45-46\"<\/p>\n

Take a look at that yellow \u201cCaution Triangle\u201d. Doesn\u2019t look so friendly does it? We view that icon negatively because we have seen similar icons elsewhere\u2026 such as on product packaging and road signs, which indicate to proceed with caution. Which is good advice! Because a page with Mixed Content can leak important information or be used for a phishing attack. However it unfairly penalized sites for trying, and using SSL on some of your resources is better than none.<\/p>\n

Website administrators and operators may have been hesitant to adopt SSL because the yellow Caution Triangle was perceived more negatively than the white Page icon reserved for HTTP, which was doing more harm than good. See, Mixed Content isn\u2019t always so easy to fix. Sometimes websites use external resources and services which don\u2019t offer HTTPs as an option. Other websites may have deployment programs using hard-coded HTTP URLs or just have large archives and the lack of resources to update them all.<\/p>\n

So, what does this change really mean? It has two great benefits. For one, it reduces the complexity of Chrome\u2019s SSL UI. We know that most Internet users have only a casual familiarity with web security, so simplifying the amount of work they have to do to know when they are secure is a good thing. Secondly, this change makes it easier for websites to adopt SSL without the browser appearing as if there is a problem. This lowers the bar for implementing SSL and simplifies the lives of web developers and admins.<\/p>\n

\"badssl\"Figure 2. Note that the white page icon is displayed here for a website with Mixed Content. The “Connection” provides more details for those who need to know<\/span><\/p>\n

For those who are eagle-eyed, you will still \u201chttps:\/\/\u201d in the address bar, showing that the site is using SSL but isn\u2019t totally secure. For those who need to know even more, you can still click the icon and view the \u201cConnection\u201d tab to read more about the particular issue. There you will see the \u201cCaution Triangle\u201d alive and well.
\nOf the major browsers, Microsoft\u2019s Edge, Apple\u2019s Safari and Opera already treated mixed content in similar ways. Mozilla\u2019s Firefox is the only browser to retain a warning for passive mixed content.<\/p>\n

Google Chrome has one of the most progressive and dedicated security teams. They have been making major improvements in Chrome\u2019s handling and communication of SSL-related messages.<\/p>\n

As they roll out their improvements we will be sure to keep you updated on the current status of SSL UI in Chrome and other web browsers.<\/p>\n

If you need SSL for your site, take a look at our product offerings<\/a>. We work with the most well-known Certificate Authorities and have a cert for everybody \u2013 from a small blog to major corporations, and everything in between!<\/p>\n","protected":false},"excerpt":{"rendered":"

Today marks the release of Google Chrome Version 46, which contains a notable change in Chrome\u2019s SSL UI Google Chrome shows a security indicator to the left of the URL…<\/p>\n","protected":false},"author":2,"featured_media":2847,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[17],"tags":[],"class_list":["post-1925","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-lowdown","post-without-tags"],"views":11633,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2016\/05\/Yellow_Triangle_Photo-1.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/1925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=1925"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/1925\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/2847"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=1925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=1925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=1925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}