While filling out a form on Amazon that requires my social security number, I noticed that even though Amazon says the site is secure, there is no padlock icon, and the numbers remain on the screen (not blocked out). Is it true that Apple no longer uses the padlock icon, claiming most sites are now secure, and now only advises users of insecure sites with a warning?
iPad Air, iPadOS 18
You're welcome. It's good to have asked. Sometimes, subtle changes can indicate something amiss. For example I'm curious which Amazon form requires a social security number. I assume it's required for a seller account but I don't intend to pry.
The short answer is that it's totally up to the website to intentionally obscure data entered in any field with •••• or **** or whatever. The decision to code the website in that manner is completely unrelated to its encryption or transmission protocol. Strictly speaking it's not even necessary to echo any characters, but such an apparent lack of response to user input would be confusing and run counter to fundamental human interface guidelines.
Whether that practice enhances overall data security or not is debatable. Clearly if someone or some thing is looking over your shoulder as you are typing a social security number or other sensitive data it's probably a good idea to obscure what you're typing. But if that someone or something is going to go through such trouble it's not much more difficult to look at what your fingers are doing instead. Personally I think it's my problem to be aware of my surroundings — a personal responsibility I don't delegate to technology.
Going further down that rabbit hole, it is theoretically possible for some sensitive equipment to remotely pick up the faint electromagnetic radiation emitted by the display you're looking at, and use that signal to recreate the images on it without any kind of visual, optical, or physical means. If a website echoes •••• characters, that's all that can be determined from what gets drawn on the screen. That's the argument in favor of obscuring information, but it is entirely unrelated to the data being transmitted to and from the website. That had been the purpose of the "lock" icon — to show the website is using encryption, which nearly all of them do now.
Not all websites use encryption; for example a website that neither contains nor solicits anything that can possibly be considered sensitive information would not require it.
However, even my favorite such page uses encryption:
<html>
<head>
<title>Blank White Page</title>
</head>
<body BGCOLOR="white" TEXT="black">
<BASEFONT SIZE=3 FACE="Arial" >
<div id="popup" style="position:absolute;top:0;left:0;"></div>
</BODY>
</html>
😄
I was invited to be a Vine member, so I had to fill out a W9 for tax purposes. If I receive more than $600 in free merch (for which I write reviews), it will be reported to the IRS. I checked with my tax guy, so I know that's legit. Live and learn…
Yes.
It's not a claim though, it's a fact. The "lock" icon has become redundant and irrelevant and has thus been deprecated.
Thanks for your reply, John. But if the site is secure, shouldn’t the numbers be blocked out?
Wow! Thank you. I don’t think I have EVER received such an extensive, detailed reply to any question on this site. I greatly appreciate that you took the time to respond this way.
Oh, ok. Thanks for the explanation!
iPad Air missing padlock icon on secure sites