Attaching 2 screenshots of before and after clicking the Jan 6 button in the bottom left.

Note how small the change is between them. You have to know to look in the omnibox to find it. And I had to reload the page multiple times thinking it was broken before it worked.

Edge also has a similar UI, though their omnibox, and the icon, are both larger and thus more visible when they appear. We could do better.

Deleted: before.png 623 KB

	before.png 623 KB View Download

Deleted: after.png 500 KB

	after.png 500 KB View Download

Able to reproduce the issue on Mac 10.12.6, Win-10 and Ubuntu 14.04 using chrome reported version #63.0.3239.132 and latest canary #65.0.3314.0.
This is a non-regression issue as it is observed from M50 old builds. 
Attaching screenshot for reference from M-50 version.

Hence, marking it as untriaged to get more inputs from dev team.

Thanks...!!

Deleted: 799771.png 755 KB

	799771.png 755 KB View Download

Thanks for the report.

Adding PMily and SWEmily for thoughts.

This UI is deliberately subtle. The indicator could also be titled "Shoot self in face" and I think we're more likely to want to remove it than make it more prominent.

I appreciate that but it also breaks existing web content, and in this case had me switching to use edge instead of chromium, which is a much larger "shooting self" as you put it IMO.

I don't think we have concrete plans to make this more obvious, and indeed, the site has the (i) icon next to the URL to indicate that the HTTPS setup isn't correct.

You can avoid this problem all together by correctly loading the unsafe scripts over HTTPS like the rest of the page. Then there is no need to load unsafe scripts at all. :)

> I don't think we have concrete plans to make this more obvious, and indeed, the site has the (i) icon next to the URL to indicate that the HTTPS setup isn't correct.

That's unfortunate. To most users it will only appear that this page is broken in Chrome.

> You can avoid this problem all together by correctly loading the unsafe scripts over HTTPS like the rest of the page. Then there is no need to load unsafe scripts at all. :)

Can you explain what you mean? How do I go about doing this when using a site such as this?

#9, ah sorry, I thought that the site was your site. The problem is they have some data loaded over HTTPS, but also load JavaScript over HTTP, which compromises the security of using HTTPS.

We are progressively working to mark HTTP as less secure in order to protect users, and part of that work is to try and incentivise sites to not have these fallbacks. Other browser vendors are also pursuing these goals in order to help improve the security of the web.

Ok yeah I get that, but this doesn't feel like it's in a good place for users to make choices atm. Like there are websites where I wanna not use http over https and it matters a lot. But here I wanna listen to music and I don't care if it's not secure, you know? So it just feels broken when it doesn't work, and I had no idea how to fix it until I noticed how in edge and came back to see.