Does HTTPS REALLY Keep You Safe?

[@techquickie]

Hello all-- We'd like to thank those of you who replied with concerns about our statements on URL and domain encryption in the later part of the video. Here is a correction to and clarification on what was presented in this episode. We should have said that HTTPS does technically encrypt the entire URL but unencrypted DNS can show what domain you are visiting (such as www.example.com). The remainder of the URL, including the specific page a user is visiting, would remain encrypted. It should also be noted that in addition to unencrypted DNS potentially giving away a domain the user is visiting, domains are also sent in plaintext to the server a user is attempting to access so that the server knows which subdomain the user wants - for example, en.wikipedia.org versus es.wikipedia.org - before traffic between the client and server gets encrypted. This is due to how Transport Layer Security (TLS) works - the cryptographic protocol that HTTPS uses. So, this is another way in which an attacker could potentially find out which websites a user is visiting is addition to looking at unencrypted DNS requests. There is a feature in the newest version of TLS called Encrypted Client Hello (ECH) that aims to solve this problem, but ECH is not yet widespread across the Web. HTTPS is a complex topic, and in our effort to explain it as succinctly and accessibly as possible, we accidentally misunderstood a piece of information provided by our fact-checkers. That is, of course, no excuse for making a mistake, which we apologize for. We hope this comment clarifies how HTTPS works, and we appreciate your patience and understanding as we continue to refine our processes; we strive to be as accurate as possible and do right by our viewers. Again, please accept our apologies. The first 500 people to use this link and code TECHQUICKIE30 will get 30% off their first order with Soylent: bit.ly/3qgAqNC

[@MikeWood]

"HTTPS is a complex topic, and in our effort to explain it as succinctly and accessibly as possible" First, thanks for posting the clarification comment. Also, generally LTT viewers are fairly knowledgeable. You could have doubled the length of the video and went into the weeds on this and there would still have been views.

[@fangleone7566]

Pin this ...?

[@SteveSunny]

A week break and they still make the same mistakes they did pre controversy. You can't make this up 😂

[@akuma2124]

Wasn't the point of the hiatus to fix things meant to stop so called "misinterpretations" likes this, and getting things checked multiple times post-production?

[@nuur2825]

@@SteveSunny this is pretty minor all things considered. Personally I don't really care.

[@Fools_Requiem]

HTTPS is just supposed to make your connection between your computer and the site you're visiting secure. It doesn't make the site more secure. It just makes sure the information you're providing to the site doesn't get intercepted.

[@jasonshere]

It secures data through encryption, it doesn't stop people from intercepting the data.

[@michaeltempsch5282]

@@jasonshere With https they'd be intercepting the _encrypted_ data though - not directly readable...

[@ehsnils]

And it doesn't stop trackers, it just makes catching and blocking trackers harder.

[@MicSec]

Yip this is the main point I always make if I'm explaining HTTPS to somebody. The connection between client/browser and the web/application server is encrypted, yes, but doesn't mean the site is necessarily safe. And because regular users don't know how to tell the difference between DV, OV and EV certificates, it's possible to have a perfectly secure connection to a typosquatted domain with a valid certificate.

[@RepChris]

@@jasonshere if you intercept properly encrypted data you might as well have intercepted random noise, the only thing you might learn is *that* there was a communication, but nothing about the contents of the data itself. Metadata yes, but even that is limited. So no, it does stop people from intercepting the data, unless you mean intercepting as in stopping the communication with the server from happening, which yes you could intercept the packets, but due to how the protocols work theyd just try again with a different route until transmission gets acknowledged

[@willfancher9775]

A couple of corrections. 1) An employer would still have to install a custom certificate authority on your computer if they wanted to put a proxy between you and the internet to monitor your traffic. This isn't exactly uncommon practice though. 2) You used the word "URL" several times when "domain" would have been correct. The difference is actually somewhat important with the topic covered at 4:10. The URL includes an awful lot of metadata that is actually encrypted by HTTPS; it's only the domain that is unencrypted

[@TheEnde124]

Also thought it was weird when they said URLs are not encrypted.

[@Neurones067]

Yes I wanted to point it too that only the domain is unencrypted. This is due of the SNI (Server Name Indication) feature of the TLS that indicate the domain you want to visit to the target server. It's used by the server to select the proper certificate to present. It's a crucial feature for mutual hosting of websites where a server can host a dozen of different websites where each one use a different certificate. Encrypted DNS does not address this issue. It indeed encrypts the DNS trafic that the browser uses to to fetch the ip address to connect to, but it has nothing to do with HTTPS. Some companies use man-in-the-middle techniques in re-encrypting trafic presenting a forged certificate signed by their own authority installed in their employees PC to gather the URLs fetched. This is used to block unauthorized websites (along with DNS blacklisting) but also to detect and block phishing links.

[@skyracer-mk8hg]

Even with encrypted DNS it is still possible to read the SNI to get the domain. Encrypted SNI is not adopted yet

[@AG-bp3ll]

A LTT video contained misinformation? How unusual.

[@kakashi99908]

I wouldnt exactly call a URL metadata

[@moritz_p]

Chrome is actually considering the removal of the lock symbol for reasons that are in part detailed in this video. People misinterpret it as "everything is safe with this site" which is never the case.

[@mbsfaridi]

I think they did a video on it aswell.

[@sireuchre]

I see the sponsor and all I can think is "Soylent Green is PEOPLE!"

[@joelviolinpiano]

same here, why would someone have their product named that?

[@bikeny]

@@joelviolinpiano I'm having the both of those thoughts as well. And I just looked it up, this year is the 50th anniversary of its release. And another tidbit, the future it talks about is 2022. So happy I am a meat eater.

[@gljames24]

I'm drinking Strawberry Soylent right now.

[@ArturoTabera]

That's good marketing for you.

[@FunctionGermany]

worth mentioning: if a website gets hacked or they don't pay their domain, someone else can do phishing and it's not possible to tell from the URL or HTTPS being properly enabled.

[@oomangaz]

Corrections: 4:17 HTTPS always encrypts the path of the URL, and the hostname is only sent in plaintext in the first part of the TLS handshake. 4:44 "Encrypted DNS" does not obfuscate the hostname, as the graphic suggested, and this is still sent in plain text in the first part of the TLS handshake because DNS is not part of HTTPS.

[@nathanpost8753]

Ltt at it's finest again lol 🤣

[@covoeus]

"Encrypted DNS does not obfuscate the hostname" - Minor nitpick: it does. The network sees what DNS server you connect to but not what you request from it. You then going ahead and leaking the hostname anyway during SNI has nothing to do with DoT/DoH, but I agree it is important to be aware of this.

[@VanBurenOfficial]

Hmmmm, I kind of feel like the host name should remain unobfuscated tbh, i'm really not into the vibe of the handshake with the TLS when the host name has been obfuscated.

[@oomangaz]

@@VanBurenOfficial yeah, it's unfortunate. It's a complicated system, so I'm going to be glazing over some details, but essentially, a single server can host many different domains, and each of these can have a different set of encryption keys. So in the initial connection phase, the server needs to know which keys (and certificate) to send, so this kind of has to be unencrypted.

[@oomangaz]

@@VanBurenOfficial lol I misunderstood your comment. The hostname never changes. That is what I was saying the graphic was a bit misleading. DNS encryption only encrypts the traffic for the DNS query. There is not any kind of "one time" domain name created. Which is kind of what I felt the graphic of the domain name changing was suggesting.

[@BigJimSportsCamper]

Soylent - ITS MADE OUT OF PEOPLE!!

[@gus473]

Not anymore. 🧐 But..... 😉

[@KoalaGiovano]

Yeah come on peopl3, Soylent when you releasing the Green flavor???

[@SexyTRex]

My kind of people!

[@GabrM]

@@KoalaGiovano They are waiting to have enough vegans and then they'll hit the market...

[@LunaStar666]

Soylent sounds like such a horrible name to me 🤣

[@snackiz]

The information at 4:11 about HTTPS not encrypting the URL is just plain wrong. The whole HTTP session is encrypted, which includes the hostname and URL. What CAN leak is the hostname through unencrypted DNS, and any listener on the way can definitely see the IP address that you are connected to. A system administrator can see your browser history, but your ISP cannot.

[@LorenzoLeonardini]

I don't understand how they've managed to make such a big mistake...

[@TheBlueLakeFish]

But unencrypted SNI still happens

[@snackiz]

Correct. But that's not showing the URL/path. @@TheBlueLakeFish

[@milneandfletch]

Http host variable is not encrypted. Its only the payload, he was right.

[@user-Cata7sti7ma7]

Sorry, but I worked for Videotron ( Canada ISP) and we can see any page people are going on If there is a warrant. The law requires it for Cyper-criminality. What Wikipedia say and what the reality is, it's 2 different thing, These are backdoor everywhere for the authority. And these same backdoor can be used by competent hacker. These are plenty of unencrypted path for cost reason. And that not specific from Canada, in the USA is even more intrusive, there can live monitor what you are watching. HTTPS encryption are so weak in today standard. We can easily say that there is none.

[@killacahji9484]

Anyone else notice how crappy and limited google search results have been recently?

[@mr.e4202]

Idk, really seems it's been a while not just recently

[@Alirezarz62]

Google's algorithm for indexing and ranking websites changes and currently it's pretty fucked up! It heavily relies on websites actually buying links and the more money you spend the better your website's position on google. So actual genuine website owners and content writers are getting screwed and the abusers and big companies with their stupid agendas are winning...

[@TheMajorStranger]

Soylent: IT'S MADE OF PEOPLE!

[@ArturoTabera]

That's good marketing for you.

[@obisstuff6884]

Not enough people know this. Soylent Green. That company made a poor choice on naming.

[@TaliyahP]

HTTPS protects from man-in-the-middle attacks but not man-on-the-end attacks

[@CoolJosh3k]

2 important details missed: 1. Since it leads to a false sense of security, it may not be shown if https is being used or not. 2. Malicious websites can fake the address bar by using frames and images.

[@Bare_Essence]

I loved the "editor says hi" traffic being sent :)

[@DiscoLizzard]

the soy ad is the most dystopian thing I've seen all year

[@thomasafine]

The reason the web didn't always have https is because very little was encrypted back then, and beyond experiments, nothing at all in the transport layer. Perhaps the interesting bit is that web led the way in security, with Netscape experimenting with it in 1994, while ssh didn't even exist yet.

[@shekelboi]

> Why Google Is Changing THIS Icon Mentions everything but what it's gonna be changed to in the video

[@bomberfish77]

Missed opportunity to put Snoop Dogg at 0:33

[@DeadPhoenix86DP]

I've changed to Firefox a year ago, and i gotta say, its been a positive experience.

[@KOTYAR0]

Ikr Mandatory tab groups on mobile Chrome with no option to turn them off made me change

[@jasonshere]

I've used Firefox for about 20 years; it's definitely one of the least intrusive and most user-centric browsers. Almost every other browser (i.e., Chromium) is hostile toward users and integrates several dark patterns so that they can obtain every possible piece of private data from the user.

[@AltonV]

@@KOTYAR0 your comment was the first time I've heard of that feature (at least for mobile), and chrome is my primary browser on my phone.

[@KOTYAR0]

@@AltonV how many tabs you have open rn? Isn't that annoying how on mobile Chrome opens new tabs in the group, so it becomes a hassle to close those what you don't need?

[@AltonV]

@@KOTYAR0 it only shows a smiley, so it's a lot (over 100) And I haven't noticed the feature before.

[@WaynoGur]

You know Soylent Green tastes different from person to person.

[@benchilcott6908]

So.. why is Google changing the icon? You didn’t address the question in the title. Edit: the title has changed now, but it was originally something like “Why is Google changing this icon?”.

[@timvw01]

I thought i missed it😅

[@snackiz]

I got so caught up in fact checking the HTTPS protoco that I actually missed that part.

[@FreeTimeFeats]

Thank you for this, would love more cyber security related content. It's more difficult to distill down, but wow does the public need better understanding.

[@funintheoven158]

Agreed! It would be pretty cool if LMG had a dedicated channel on the subject. Definitely no shortage of content!

[@saulgoodman2018]

Asides for Anthony, it may be too technically hard for them to understand.

[@mastenk2030]

@@saulgoodman2018 *Emily

[@saulgoodman2018]

@@mastenk2030 Anthony, I'm not talking about that editor..

[@d3ltaLX]

@@saulgoodman2018 *Emily

[@thirdbeat]

i really wish they also explained HOW lets encrypt created a somewhat shift in how certificates was generates, going from a "manual verify domain, manual download cert, upload to site", to ACME, doing 90% of this job for you

[@JustPlayerDE]

its automatic and the most minimal proof of ownership thats how they do it for free if you request a certificate they literally just start a request on a specific url (or check dns metadata) on your server to verify that the request is actually valid. then they give you a certificate that can do not more than encrypting the traffic and validating that the server is valid for that domain while beeing limited to only 3 months of validity the CA's where you have to pay (a lot) want to manually approve you or at least require you to fill out some forms to get proof that you are an entity owning that domain and will give you a certificate that MAY do more than what lets encrypt certificates do while beeing valid for up to 3 years funfact: if you see a name instead of just a lock in that place it is actually a proof of trust (e.g. "Valve Corp" for any steam site) because that is (as far as i know) the most expensive type of certificate that even certifies that you are a specific entity and not just a specific domain (a lot of banks used them) but at least chrome (and chrome based browsers) do not care about that anymore and only show that verification if you actually click on the certificate information on the lock

[@thirdbeat]

Great write up, however: many "paid for" certificates also support ACME as part of their solution (godaddy, digicert etc). most of them have a 1 year expiry and not just 3 months. the big drawback here is, and you touched on this, is that they are just domain validated, and not organisational or extended validated certificates (allthough globalsign announced ov certificated through acme in march). I just wanted them to touch in on this point as well as while ACME sounds simple, it just fueled alot of the progress in web dev over the last few years. before there was an actual cost to create a website, but now, you can do it in 30 minutes for free @@JustPlayerDE

[@nicogartner2332]

I think you forgot about the Client Hello which transfers the domain name unencrypted, during TLS connection startup, even using "private DNS" (DNS over TLS / DNS over HTTPS). Support for ECH (encrypted client hello), which encrypts the domain is still very uncommon.

[@RMerlin]

Or ESNI, which will also encrypt the hostname found in the HTTP query, unfortunately it's also not very widely implemented. There are quite a few things available out there to better secure our Internet activities, but with very limited availability. DNSSEC also comes to mind here.

[@LiEnby]

​​@@RMerlin? The entire http request is already encrypted in https, sni must be something else ..

[@CoolJosh3k]

I would have found it really funny if the sponsor for this was a VPN provider.

[@soundspark]

Would be too suspicious especially when such providers got in trouble for misleading advertising.

[@TTM1895]

Finally, some mid-range tech information.

[@reddcube]

I like that more and more libraries and schools are straight up blocking HTTP.

[@ThePortuguesePlayer]

This is sarcasm, right?

[@tacokoneko]

it's pretty inconvenient for programmers but i think if i was homeless and had to use library computers i could quickly reprogram the computer to do what i want discreetly and either reset it when done or dual boot it back to original state. if they notice, i can go to other libraries until i find one that doesn't notice programming. police arrest homeless people for being outside all the time so it's not like the library would be my biggest problem. it's not like i install crypto miners on the computers so they shouldn't really care

[@Aera223]

@@tacokoneko even easier, use local files for programming, or a proxy that has https

[@silverfox9947]

Your haircut and T-shirt keep changing. Is this confirmation of the parallel universe theory? Only Techquickie could achieve that.

[@eppiox]

EVERY job place i've worked at has had a their own authority installed so log into places at your own risk. Also implementing certs / and checking on established sites.. has always had me dumbfounded with how lax the private certs are kept - imo it's a flawed process but I can't think of anything better - absolutely hate them for how socially unaware certs are.

[@VividNation]

soylent.. REALLY? whats their best selling Meal... the Green one?!

[@dominikbeitat4450]

Honestly, ever since I've discovered the Lockpicking Lawyer, that little padlock icon stopped inspiring any sense of security for me.

[@Explodenator]

I'd like to suggest you do a video about USB 3.0 devices creating radio interference in the 2.4ghz range, affecting wireless devices like mice and keyboards. Apparently it's a known issue, but not really talked about.

[@12thDim]

I just looked that up. Thats really interesting and I never knew that was a thing

[@AltonV]

USB has a white paper on their own site dated to 2012 that details the issue.

[@realcartoongirl]

my employer spy on the employee by proxying all web browsee and using their own certs on the laptops so it still show https but they spy on every thing you post

[@jdmancillasalvo4062]

I'm sorry I lost track of the amount of times the color shirt changed and beard growth to clean shaven. 😂

[@deejrdee1]

I thought I was the only one. I kept wondering why he looked different in each cut. It's not distracting to me, but it's hilarious now that I've noticed it.

[@xoso599]

I love how the security of HTTPS is just built around 'trust us bro', we are totally going to be secure when we sign this.

[@pascha4527]

Well, https is to secure the connection between your computer and the server. Your computer will validate that you are talking to the correct server by matching the locally stored certificate with the certificate the server provide. There is no "Trust us bro". But, yeah some certificate authority have been known to be insecure in the past. Which rendered all of the issued certificate to be untrustworthy. Its still a very solid system, you never (almost never) encounter a server that try to act as another one.

[@xoso599]

@@pascha4527 If the system wasn't built around just trust us bro you wouldn't need them at all. How do you know, not believe that every signing authority is both secure and honest and not subject to for example government level interference? You don't because you can't, so it's back to just trust us bro.

[@BenjaminCronce]

@@xoso599 That's not the attack vector I'm worried about. If my government wants my head, they'll have it with little effort. I don't want some rando in another country getting access to my bank account. And there's nothing stopping you from setting up your own CA and only trusting that. Not like you'd be able to use anything, but it'd work perfectly. HTTPS really is great. It's the CAs that are the weak points, but if that's all you need to worry about, HTTPS is awesome.

[@AzureBlade07]

4:17 "hi everyone - editor :)"

[@BillyBobDingledorf]

Of all the LTT videos released since the "incident", this is the most useful. Thank you.

[@chuuni6924]

If you're critiquing HTTPS, I think a fair mention should be made to the fact that any one of the many certificate authorities that are pre-configured on most operating systems, many of which are ran by various state actors, can arbitrarily create fake certificates for *any* site, not just one originally registered with them, and the fact that it is a historically documented fact that a lot of the CAs have been creating fake certificates for law-enforcement agencies.

[@MicSec]

That sounds fascinating and I'd like to read up on that. Could you please provide 3 unrelated sources that I could view relating to CAs providing certificates to law enforcement.

[@laitinlok1]

Yes when you generate a certificate using certbot, the CA uses http or dns to authenticate the authenticity of the domain, which both can be hijacked to redirect the request to the wrong server if it is a nation state actor

[@chuuni6924]

@@MicSec For the record, I've tried posting links to sources, but it seems KZbin doesn't let me, since it just removes the messages without even telling me about it. However, if you google around for "Verisign", "CALEA compliance" and "certificate", I'm sure you'll find enough anyway.

[@Shirwatel]

getting two version of Riley in one video is just too wholesome lol

[@alexatkin]

Feel like I'm seeing a definite improvement in the accuracy in Techquickie. The fact you mentioned "may be able to see what page you visited, depending on how the server is configured" is the sort of detail you had been skimming over in the past. I hope this quality continues as its often the little details that are important.

[@krylesangerbeaver]

I dunno, they already had to PIN clarifications and a few comments point out verbiage issues. Edit: In a 5 minute video about pretty old stuff

[@Narxes081206]

​​@@krylesangerbeaveragreed this isn't showing an improvement in quality given the final product has several errors.

[@AndyAlert]

nah

[@laitinlok1]

Idk if they are talking about the reverse proxy able to see what page you are visiting

[@skooterfd]

Soylent Green is made from Humans... Loved that movie!!!

[@jordananton]

At 0:56 you say the certificate is the electronic document "used to generate the https encryption". This isn't quite right. You don't need a certificate to generate an encrypted connection. The certificate is there to establish TRUST. So that you know the server on the other end is who they say they are (as you mention later).

[@Yanni_X]

What is meant with the statement at 4:00? If DNS is poisoned and returns a malicious IP, the certificate won't be valid. That's one of the main features of HTTPS, because the malicious site (normally) can't provide a valid certificate for that domain

[@NoOne-fe3gc]

Everytime I see a Soylent add I chucke. The lack of awarness in the company name will never NOT be funny

[@joebidenofficialpotus]

I think they know From wikipedia "Soylent is named after a food in Harry Harrison's 1966 science fiction novel Make Room! Make Room![13] In the novel, most types of soylent are made from soy and lentils, hence the name of the product, a combination of "soy" and "lent". The word also evokes the 1973 film adaptation Soylent Green, in which the eponymous food is made from human remains.["

[@samuelloader8213]

Did the editor ever find the answer to his question as i would also like to know "how many penguins can you legally put on a unicycle"

[@modimihir]

ya this is what i came to ask

[@CyFr]

Recently got sick and soylent was the only thing I could keep down.

[@joelviolinpiano]

Soylent makes a mint chocolate flavor. It has a green label on it.

[@KuruGDI]

What did Colton do that got him fired and that is the reason why he basically became an LTT meme at this point.

[@mattthemouse1]

A crazy thing the US Government does on their defense contractor websites; *You* have to manually obtain and install the cert packages in order to display the website properly.

[@Jekkku0925]

Gray and beige shirt, my brain went beep boop

[@cheesemonkey9638]

Messed with my mind as you shaved and got a new t-shirt at times 😂

[@youtubecommenter4213]

...why would a nutrient drink company call their drink soylent? do they just assume that people these ads are targeting have never heard of soylent green?

[@eg133770]

0:31 Hi editor.

[@KOTYAR0]

My mobile network provider INJECTS ads in between content on those old http websites, and I'm not joking at all rn.

[@pieroo900ng]

cool stuff. make a video about apple's iCloud limit IP address tracking and how secure web browsing on apple devices really is..

[@mattthemouse1]

Soylent is wonderful! My favorite flavor is green, but the taste varies based on the person

[@miquerto]

Dude, your beard grows fast. Oh, and goes away fast too. :-)

[@myplane150]

Riley's haircut is a nice insight to how long these vids must take to make...☺

[@mon94key]

Would have been nice if you went into the issues with security certificates like antivirus programs pinning it resulting in issues when a company updates the certificate

[@smartwerker]

You did it instead!!! 🤣🤣🤣🤙

[@chronometer9931]

4:37 He can't keep getting away with it!

[@maxkendal5152]

Will there be a Soylent Green?

[@gus473]

Is that Red Green's cousin? 🤔

[@maxkendal5152]

@@gus473 Never seen the movie or read the book?

[@ArturoTabera]

It already exists.

[@LupusGr3y]

HTTPS is the reason you don't need VPNs for privacy reasons. Your connection is already encrypted.

[@firebadnofire9768]

HTTPS protects you from outside parties, not the server you are communicating with

[@osamasalah-ud-din6585]

The constant back and forth between Riley and his evil twin was certainly a bit off putting 😂

[@blackpaperbold]

Administrator with DPI: Pfft, wtf are you doing? Blocked!

[@AvtarSinggh]

Here's a video suggestion, how to figure out which gpu will perform best with my cpu and how to check the bottleneck percentage?

[@coctailrob]

KZbin search is my go-to to see how well matched they are.

[@AvtarSinggh]

@@coctailrob but some not on KZbin

[@Damian-rp2iv]

Your boss can not just look are your stuff with only proxies.. It also has to manage your browser install (often done in companies) otherwise he's as blocked as everybody else And uh yes, HTTPS does encrypt URL, only the domain will be seen from outside

[@TheMercifulKnight]

Not browser install. Cert authority install. You can have whatever browser you want , won't stop corp from snooping if they have their own cert auth installed.

[@Damian-rp2iv]

@@TheMercifulKnight This is just one way to do it even if the most common off course. That's why I've try to take a generic phrasing for everything going around browser. But you're right that I should give more precise explanation so thanks for the comment! i just wish we did not had to fix what was said in the video at the first place...

[@dalemarcus1371]

Good job explaining. Technically correct and simply explained.

[@Killer128_TF]

Poor Colton never gets a break!

[@eldibs]

Soylent? They really named their company Soylent? Does it come in green?

[@fietsband08]

I can’t be the only one that is surprised that Soylent still exists.

[@EelcoPeterzen]

Soylent??? Please tell me they don't have a green variant... Just checked. They do, but they call it Mint...

[@avayaridatrane2836]

I am so distracted by the switching of the lighting, shirt and the haircut throughout the video AHHHH

[@shesh32]

0:26 "Can you legally put on" What exactly was the editor planning on?

[@samuelloader8213]

Look just before and there is a couple of frames that has the rest. Actually says "how many penguins can you legally put on a unicycle"

[@robatron1011]

Soylent Brown is pretty good but have you tried Soylent Green?

[@donc-m4900]

So how many times did Riley change his shirt? Is it Gray, is it Tan? Either it was done over two days, or they made some corrections.😊

[@kissmychakram1]

Thought I was going mad! Glad you saw it too.

[@vaodinYT]

hair change too

[@matiasg19]

Where is actually shown what the new icon looks like? Watched the video twice and always saw only the padlock.

[@itsdeonlol]

Thanks Riley!

[@UnluckyJellyfish]

The opposite of shame is pride.

[@roronoa_d_law1075]

Video starts at 3:26

[@NeonVisual]

Is this that uber expensive green screen tech Linus workshyBastian was talkin about?

[@gus473]

Son: Did you get a haircut? 💈 Dad: Actually, I got them ALL cut....! 🤣🙄✌️

[@donc-m4900]

I got my ears lowered.

[@donc-m4900]

Did you stand in line at the barber? Then you were in a barbecue...

[@gus473]

​@@donc-m4900 D'oh! 🤣

[@BradLoyo]

great work LMG! Rome wasn't built in a day but we can already see lots of improvements in the content. keep up the great work!

[@chasapple4]

Also there are some places that don't have TLS 1.2 being used for the HTTPS connection and it will break the HTTPS from show and most browser will refuse to load that weaker pre TLS 1.2 site

[@twilightsass517]

Soylent is people.

[@TheMrR9]

Soylent is people! IT'S PEOPLE!

[@ArturoTabera]

That's good marketing for you.

[@liadsagi3]

But why google changing this icon??

[@am53n8]

Many years have been spend dumbing the whole thing down to "green lock = safe", good luck trying to get people to check certificates

[@wisteela]

Soylent: Do they do a green one?

[@oofer_]

Wait, Soylent is a real thing? I thought it was just part of the soyjack memes

[@vladislavkaras491]

Thanks for the video!

[@RandomShortsFamily]

Riley with his mid vid outfit and hair change 😂😂😂

[@kiplittle]

SO . . the mint Soylent . . is GREEN!

[@garynagle3093]

Great video. Keep them coming

[@latrofu]

Soylent Green? I can't wait!

[@VaraNiN]

0:30 Hi, editor!

[@paggoose]

why did your shirt change

[@SUPER7X]

Lol we got this video 3 months ago but okay (“Google Chrome Is Ditching This Feature”).

[@matrixstuff3512]

Man I havent heard of soylet in forever

[@suzyturquoiseblue-]

Firefox will warn if a site you are trying to visit doesn't have https.