Even more interesting: In the current Firefox nightly inputs with `type=&quot;password&quot;` on insecure origins are being marked explicitly as insecure. This also includes common anti patterns such as loading an iframe from a secure origin on an insecure page.<p>There&#x27;s a screenshot of this on my latest blog post[1] and another article[2] on this topic.<p>I am very happy to see browser vendors pushing for HTTPS adoption and forcing the hands of developers. Further highlighting poor security like this also means that users are made aware and can opt out of using websites with poor security practices.<p>1: <a href="https:&#x2F;&#x2F;hugotunius.se&#x2F;2016&#x2F;01&#x2F;24&#x2F;how-browser-vendors-are-pushing-for-https-adoption.html" rel="nofollow">https:&#x2F;&#x2F;hugotunius.se&#x2F;2016&#x2F;01&#x2F;24&#x2F;how-browser-vendors-are-pus...</a><p>2: <a href="https:&#x2F;&#x2F;www.fxsitecompat.com&#x2F;en-CA&#x2F;docs&#x2F;2015&#x2F;non-https-sites-containing-login-form-will-be-marked-insecure&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.fxsitecompat.com&#x2F;en-CA&#x2F;docs&#x2F;2015&#x2F;non-https-sites...</a>