Sean Wright -- Google Chrome and the Case of the Disappearing HTTP

What changed when Chrome began labeling ordinary HTTP pages as not secure, and why did that decision provoke resistance? Application security practitioner Sean Wright explains the browser changes in their 2018 context and makes the case for protecting every website with TLS. He separates encrypted transport from trust in a website, examines how unencrypted traffic can be read or modified, and discusses the objections that complicated wider HTTPS adoption. The conversation covers accessible certificate options such as Let’s Encrypt, the role of Cloudflare, and the usability benefits of safer browser defaults. Sean also explains how HTTP Strict Transport Security and preload lists address downgrade opportunities. It is a useful historical discussion of the shift from optional encryption toward an HTTPS-first web.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Sean Wright:
→ Sean Wright’s blog
→ Sean Wright’s portfolio

Mentioned in this episode:
→ Let’s Encrypt
→ HSTS Preload List
→ HTTPS Everywhere — retired browser extension

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Chrome, HTTP, and Sean Wright
01:49 Sean’s route from development into security
03:23 What TLS protects
04:11 Why every website needs encrypted transport
05:34 The controversy around HTTP warnings
07:45 How unencrypted traffic can be modified
08:46 Misinformation and objections to HTTPS
10:34 Let’s Encrypt and accessible certificates
16:20 Safer defaults and usable security
20:22 HSTS headers and preload protection
22:38 Resources for understanding the change