For years, the padlock displayed to the left of a URL in the address bar of Google Chrome has been a security indicator that at first glance confirmed that we were connecting to a secure server that has an SSL certificate which accredits his identity and, in addition, enables the communication between the client and the server to be encrypted, thereby guaranteeing data security during transmission. So, since 2018, the Google web browser has been warning us about an insecure connection with this element.

If you are a user of You have probably noticed a clear development in this regard in recent years. When Google Chrome implemented this measure, it was still quite common to find websites without an SSL certificate. Today, however, it is really unusual to find sites that do not have this, especially if we are talking about professional sites, because on personal ones it is more likely, even today, to find this circumstance. In these cases, the padlock is replaced by a warning sign (an exclamation point inside a triangle accompanied by the text “Not secure”).

However, it happens that the fact The fact that a website has an SSL certificate does not necessarily prove that it is secure and reliable. And this nuance, which at first glance may seem like a small detail, is actually much more important than it seems. Because? Because interpreting a padlock as a sign that we can blindly trust what is in front of us is a security threat, due to a false sense of security.

Google is aware of this issue and has been wanting to make changes to end it for some time. And now it finally seems that there is a date for that, because Google Chrome 117 will no longer show a lock for secure connections, as we can read on the Chromium blog. In the said post, the company perfectly explains the paradigm shift of these years with the following paragraph:

«The lock icon is meant to indicate that the network connection is a secure channel between the browser and the website and that the network connection cannot be tampered with or eavesdropped by third parties, but it is a holdover from a time when HTTPS was not common. . Originally, HTTPS was so rare that at one point Internet Explorer displayed a warning to users that the connection was protected by HTTPS, reminiscent of the “Everything’s OK” alarm from The Simpsons. When HTTPS was rare, a lock icon highlighted the additional protection provided by HTTPS. Today, this is no longer true and HTTPS is the norm, not the exception, and Chrome has evolved accordingly.»

For an explanation of how dangerous a padlock can be today, see this next paragraph:

«For example: we know that a lock icon does not indicate the trustworthiness of a website. We redesigned the lock icon in 2016 after our research showed that many users did not understand what the icon was communicating. Despite our best efforts, our research in 2021 showed that only 11% of study participants correctly understood the exact meaning of the lock icon. This misunderstanding is not harmless: almost all phishing sites use HTTPS, which is why they also display a lock icon. Misunderstandings are so widespread that many organizations, including the FBI, post explicit guidance that the lock icon is not an indicator of website security.»

That is, by deleting, replacing with another that is associated with settings and configuration, you avoid the overconfidence caused by the padlock. The padlock, yes, will continue to appear when we click on the new icon, now next to the text “The connection is secure”, giving clearer information about it

If you’re a Google Canary user and want to try it out, you can do so by following these steps:

1. Type “chrome://flags” (without quotes) in the address bar.
2. Search for “chrome-refresh-2023” (also without quotes).
3. When flagchange its status from “Default” to “Enabled”
4. Finally, restart your browser, go to any web page and you will see a new icon: