Intent to Implement: Autoupgrade Mixed Content (Experiment)

367 views
Skip to first unread message

carl...@chromium.org

unread,
Oct 5, 2018, 12:54:27 AM10/5/18
to blink-dev
carl...@chromium.org This feature is an experiment (planned to be rolled to 1% of stable) to autoupgrade mixed content, different variations will be tested, one upgrading only blockable content, one upgrading only optionally blockable content, and one upgrading all mixed content. All of those will be tested without fallback (breaking the load if there is no version of the resource available over HTTPS), and with fallback to HTTP. The current UX for mixed content is not ideal (downgrading the security chip, or showing a shield for blockable content), we are trying to determine how feasible is it to autoupgrade mixed content and eliminate this UI, increasing user security and making the user experience better. Firefox: Public Support Edge: Mixed Public Signals Safari: Public Support
https://lists.w3.org/Archives/Public/public-webappsec/2017Oct/0017.html Web developers: No signals
We expect the experiment to cause breakage in some sites, and plan to measure the breakage to make a decision as to whether a similar type of upgrade can be implemented as a separate feature. This will be mitigated by only being enabled for 1% of users. None Yes
https://crbug.com/872446 https://www.chromestatus.com/features/5557268741357568

Carlos IL

unread,
Oct 5, 2018, 12:54:48 AM10/5/18
to blin...@chromium.org

Yoav Weiss

unread,
Oct 6, 2018, 12:37:42 PM10/6/18
to Carlos IL, blin...@chromium.org
Thanks for working on this. Seems a worthwhile goal to experiment with!

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAABgKfX-ietwKTD5dnY5zKZ7424L35pAkFvtViyqa3me_QTDyA%40mail.gmail.com.

laure...@gmail.com

unread,
Feb 13, 2019, 4:05:45 PM2/13/19
to blink-dev
And if a non-techie user happens to be in that 1% and is faced with a broken site as a result -- perhaps one they seriously need to access -- their expected course of action is ... what?

--Lauren--

Carlos IL

unread,
Feb 19, 2019, 1:06:25 PM2/19/19
to laure...@gmail.com, blink-dev
Currently we are only running the experiment on Canary, which is not normally used by non-technically inclined users, and where some breakage is expected. We will only proceed with the experiment on Beta (and then stable), if the Canary results show that breakage is not significant/if outreach can correct for most of it.

--
You received this message because you are subscribed to a topic in the Google Groups "blink-dev" group.
To unsubscribe from this topic, visit https://groups.google.com/a/chromium.org/d/topic/blink-dev/ZJxkCJq5zo4/unsubscribe.
To unsubscribe from this group and all its topics, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/c9193deb-db5d-493c-9248-a761df85e961%40chromium.org.
Reply all
Reply to author
Forward
0 new messages