3aIT Blog

A padlock sitting some some chainsIt's probably something not many of us notice these days, but almost all website addresses start "https" now. This indicates a secure connection between your browser and the website. Starting next year, Chrome will effectively force this change, which may have implications for some old internal systems.

It used to be that your browser would make a big song and dance about secure sites, with a prominent green padlock showing. This has been deliberately scaled back over the years as more and more websites moved over to https to the point that it's now assumed pretty much all will be (It's somewhere around 95%-99% now).

What Google will be doing is enabling a setting called "Always Use Secure Connections for public sites" for all users by default. What that will mean in practice is you'll get a much more prominent alert if you try and visit a site that isn't using a secure connection. If this is a public site, you should be very suspicious if you ever see this message. Setting up a site so it uses https can be literally free, so there's almost no good reason for a site on the wider internet not to have this set up these days.

Where this may cause a few more issues is on some old internal systems - company intranets etc. These may have been created years ago and, as they're not accessible to the wider world, getting it running over https was never deemed necessary. Following this change, Chrome will still allow you to visit these pages. but it will make you confirm that you really want to. This isn't because these systems have suddenly become any less secure than they already were. It's just that Chrome will be making a point of alerting you to it.

Although we've mentioned it before, one thing that's always worth mentioning when this topic comes up is that although https / a browser padlock does mean the site is "secure", you should never use it as an indicate that a site is genuine. As mentioned earlier, the process to get your website running over https is literally free. Anyone can do it. All it means is "The person that owns this domain (or someone malicious with access to the domain settings) has gone through a process to secure this site". No-one has checked this person or organisation is who they say they are, so don't use this as even a small indicator that you should trust any given website when you're evaluating what you're looking at.