meacer@, is this something you can decide whether or not we should fix? Thanks.

I don't think this issue needs to be view restricted.

Similar to https://bugs.chromium.org/p/chromium/issues/detail?id=626951, but this variant is "Basic authentication is unsafe over clear channels". That's true whether the credentials are in the userinfo component of the URL or in response to a basic authentication prompt. 

Offering a Policy mechanism to block support of BASIC auth (either entirely or only via non-secure channels) seems like a reasonable feature request. Today we only provide a subtle warning in the credential prompt.

Compare: http://httpbin.org/basic-auth/user/passwd vs. the HTTPS version.

There's also been some discussion of blocking the use of userinfo in HTTP-scheme URLs, but some worries about compatibility. https://www.chromium.org/Home/chromium-security/security-faq#TOC-Is-Chrome-s-support-for-userinfo-in-HTTP-URLs-e.g.-http:-user:password-example.com-considered-a-vulnerability-

Removing restrict-view since this is a feature-request.

I think you were unfair to the person submitting this issue: https://bugs.chromium.org/p/chromium/issues/detail?id=626951 
They detailed exactly this issue in a variety of ways.

Please ask yourselves the question, Why do all other browsers warn when a user inputs a URL-Encoded http-basic request to a site that isn't returning a WWW-Authenticate from a probe?

>> either entirely or only via non-secure channels
   It's really not about secure vs insecure channels though. It's about a URL looking like it should go somewhere that it will not and chromium has the ability to warn a user of this ahead of them potentially being phished/cookies stolen/etc. 

I note that you grey the username:password part in the navigation bar. But how many user's are going to inspect that before navigating there, especially if this comes from an email where they just click it.

Adding Enterprise label for the new policy request.

Making the bug available.

> I note that you grey the username:password part in the navigation bar. 
> But how many user's are going to inspect that before navigating there,
> especially if this comes from an email where they just click it.

Userinfo isn't shown in the URL bar at all when you navigate to a URL containing userinfo. It's only shown in gray as the user edits, and it's removed as soon as they hit enter.