Google Chrome now asks users for permission before connecting to an HTTP site for the first time, adding a warning before that traffic proceeds. After a user approves access, Chrome suppresses further warnings for that site unless at least two weeks pass without another visit.
The protection has exceptions: Chrome's default behavior skips warnings for sites unable to obtain an HTTPS certificate trusted publicly. Those exceptions include single-label hostnames such as intranet/ and local IP addresses such as 192.168.0.1, which people often use to configure home wifi routers and similar equipment.
Read more: Google Cleared 420 Football Fields of Finnish Forest Before Its Environmental Review Was Done
Google says those local hosts generally face less risk because an attacker would need access to the user's local network to alter the traffic. The warning therefore does not appear for every HTTP connection under Chrome's default settings.
In initial deployment data, nearly 95% of desktop Chrome users encounter no HTTP warnings during a given week, while fewer than 1% encounter at least three. Google says users on mobile receive warnings even less frequently and expects the frequency to decline further as HTTPS spreads.
Google credits widespread HTTPS use with making the change practical without repeatedly interrupting users, while acknowledging that some people still regularly need HTTP sites. The company describes Chrome as the first browser to introduce this behavior and says it hopes competing browsers adopt similar protections.
