I think that&#x27;s the point---they should assume the worst.<p>It&#x27;s part of a general trend of moving the needle from &quot;Internet services are insecure and if you really want to send something secure, you should be sure your channel is encrypted&quot; to &quot;These channels should always be secure; if they&#x27;re not, here&#x27;s a big red flag to warn you that they are not.&quot;<p>See also the process of bypassing the &quot;This site is insecure&quot; alarm interstitials in Chrome and Firefox these days for sites with bad secure TLS credentials. The frog has been boiling from &quot;We warn the user with a tiny icon they&#x27;ll probably ignore&quot; to &quot;Users have to know secret words or convoluted config flows to bypass this inescapable error panel.&quot;