Upcoming Change to Chrome's Identity Indicators
Devon O'Brien
Hello chromium-dev@ and security-dev@,
As part of a series of data-driven changes to Chrome’s security indicators, the Chrome Security UX team is announcing a change to the Extended Validation (EV) certificate indicator on certain websites starting in Chrome 77. You can read more about this EV UI change in the Chromium documentation here.
On HTTPS websites using EV certificates, Chrome currently displays an EV badge to the left of the URL bar that looks like this:
EV UI as of Chrome 74
Starting in Version 77, Chrome will move this UI to Page Info, which is accessed by clicking the lock icon:
Merged EV and Page Info UIs in Chrome 77 Canary
Through our own research as well as a survey of prior academic work, the Chrome Security UX team has determined that the EV UI does not protect users as intended (see Further Reading in the Chromium document). Users do not appear to make secure choices (such as not entering password or credit card information) when the UI is altered or removed, as would be necessary for EV UI to provide meaningful protection. Further, the EV badge takes up valuable screen real estate, can present actively confusing company names in prominent UI, and interferes with Chrome's product direction towards neutral, rather than positive, display for secure connections. Because of these problems and its limited utility, we believe it belongs better in Page Info.
Altering the EV UI is a part of a wider trend among browsers to improve their Security UI surfaces in light of recent advances in understanding of this problem space. In 2018, Apple announced a similar change to Safari that coincided with the release of iOS 12 and macOS 10.14 and has been implemented as such ever since.
Information for Embedders
This change is being incorporated into the Chrome-specific UI code and will not affect embedders that are based solely on the underlying content layer. Embedders that incorporate the Chrome-specific code will either take up these changes or maintain a diff from the master Chromium branch.