Chrome Version: 68.0.3423.2
OS: Linux
What steps will reproduce the problem?
(1) Start typing an origin you regularly visit into the omnibox via https (eg. "faceb")
(2) Select a history entry and hit enter
What is the expected result?
Expect to directly load the https version
What happens instead?
Autocomplete appears to default to http. Many sites of course uses HSTS to redirect to HTTPS, but this adds latency and still exposes me to potential network attack (eg. I might not notice that selecting facebook.com actually redirected to a phishing site named https://facebok.com).
I find this particularly annoying for sites I regularly visit which aren't yet using HSTS. Eg. I start typing "web-con" to get to https://web-confluence.appspot.com, but have to always remember to manually add the https:// prefix. Sometimes I forget and embarrass myself by sharing an http URL when https would have worked fine.
With HTTP being discouraged and marked "not secure", Chrome should really direct users to HTTPS first whenever possible.
Perhaps this is related to the issue question of whether typing "foo.com" in the omnibox should someday default to HTTPS. But we shouldn't have to block on that here. Maybe just add an implicit https:// prefix to all omnibox autocomplete searches and put those results first so that if both "https://facebook.com" and "facebook.com" are potential autocomplete results, the user is more likely to choose the former. Today I don't even get an option for https://facebook.com when I start typing "face" (but I do if I type the longer "https://face").
Comment 1 by jochen@chromium.org
, May 9 2018