I’d personally like to see the lock stay in the UI, but it’s meaning redefined. For a decade or more, the public has been told that the best way to tell if your information is safe is to look for the lock. I’d venture 99% of the general population doesn’t really know it symbolizes the use of SSL. They just know that it means your information is “safe�.

I totally understand that, but I’ll offer a few points to consider, on the off chance that you haven’t already. First off, 99% of the general public doesn’t notice the lock, understanding or no. Sad, but repeatably demonstrated in academic research like http://people.deas.harvard.edu....._works.pdf . Those that do are as likely to trust the ones in content as the one in chrome. The same studies find that the vast majority of people do look to the location bar for identity information though, so hope is not lost if we can find a way of communicating more clearly (and non-annoyingly) in the places users already look.

Second, as other commenters have beaten me to pointing out, the lock DOESN’T mean “safe” and that’s the problem. Ask non-sophisticated users, and they have all kinds of expectations about what that lock means that aren’t borne out by what it actually represents. Telling them to look for the lock to know they’re safe is the big lie we’ve been telling, and that’s something that I don’t think we should do. It makes them feel safer without being safer – I like making people feel safe, but I don’t like them being spoofed by the bankofamerica phishing site that actually goes and buys a $20 cert (though see above, that’s rarely necessary since most people don’t notice.)

Last, I’ll point out that I’m not at all immune to the argument that even if we think we’re going in a better direction, weaning people off what they’re used to should be done gently. Clicking the site button popups up an identity dialog, which includes, when the connection is encrypted, a padlock which says as much. The padlock is fine as a symbol for encryption, but encryption is not the same as safety, and giving encryption so much top-billing as safety does users a disservice. It is also, incidentally, still in the status bar. Baby steps.

Johnath