Hacker News Reader

That's an interesting point. I'll be straight, it's lifted right from https://istlsfastyet.com. And cio.gov is in the HSTS preload list [1] so (once the list makes it into stable channels) the chances of the domain being downgraded to plaintext are pretty low. But I had not thought of that angle. Hmm.

[1] https://18f.gsa.gov/2015/02/09/the-first-gov-domains-hardcod...

View on HN

..and people complain about transparency :)

I wasn't calling it a social engineering trick, more that it just felt like one. To the average person they wouldn't second guess the icon. To those who believe in HTTPSAllTheThings, we question anything out of the ordinary.. and that little padlock shouldn't appear in the tab.

As I said, it just felt weird, sort of the same feeling you get when you go to Apple or YouTube and there's a warning on the lock icon. You just want to hit the back button almost instantly fearing something dodgy is happening.

You were absolutely right in calling it a trick. Browsers explicitly[0] stopped putting the favicon there as sites started to trick users like this.

Seems like an odd choice of UI chrome that browsers decided to keep.

0: http://www.wired.co.uk/news/archive/2012-04/25/firefox-fires...

Reply on news.ycombinator.com