Repro page: https://www.whytls.com/test/mailto.htm

The mailto: protocol enables submission of web forms over email. In the browser itself, we don't have any way to know whether the mailto: protocol handler is going to behave in a secure manner. It may (HTTPS transport end-to-end) or it may not (non-authenticated SMTP), and thus I think this warning is appropriate. 

More generally, mailto: is pretty horrible from a privacy point-of-view (since it leaks the sender's email address). Launching such a link from IE shows:

---------------------------
Windows Internet Explorer
---------------------------
This form is being submitted using e-mail.
Submitting this form will reveal your e-mail address to the recipient,
and will send the form data without encrypting it for privacy.

You may continue or cancel this submission.
---------------------------
OK   Cancel   
---------------------------

Firefox shows:

---------------------------
Security Warning
---------------------------
The information you have entered on this page will be sent over an insecure connection and could be read by a third party.

Are you sure you want to send this information?
---------------------------
Continue   Cancel   
---------------------------

Notably, unlike Chrome, neither Firefox nor IE revokes the lock icon upon the initial display of the page. 

elawrence@: I don't think that argument is trying to justify an edge case that we didn't think about, or where too lazy to address.
Chrome sometimes *does* know the protocol handler (e.g. GMail or Inbox). And on the other side of the coin, even an HTTPS form submission may redirect to an HTTP page or be handled on the backend in a way that leaks details.

I'm interested in hearing from Mike whether anyone has explicitly thought about this for Chrome.

1. Max sits next to me, so it's totally important that we fix this one way or another so I can avoid the evil eye. :)

2. I never thought about `mailto:`, no, but I like Eric's retconned justification for the current behavior, if not the current message.

So, let's change the message, but keep the UI-degrading behavior? Fewer `mailto:` forms is better `mailto:` forms.

Also, I don't like either IE or Firefox's current behavior.

Sounds good!