I'm very confused. I'm on Chrome 41, which shows the XKCD page (https://xkcd.com/) with no lock and the blurb about outdated security settings. I installed Chrome Canary, which is on version 44, and I was expecting the red X. But instead I'm getting a green lock and no warning message. What's up with that? Is this code not deployed to Canary yet?
Edit: installing version 42 does show the red lock, so I guess it's a Canary issue.
TBH, xkcd is using pretty outdated crypto all over the place, not just the sha-1 issue (though that's there too).
xkcd.com still supports SSL3 which can't really be trusted any more and it either supports really bad 56 bit single DES or RC4, neither of which are adequate any more.
Ok. it's a web comic, so SSL isn't of that much importance, but I would certainly prefer chrome to warn me when visiting a site using these settings, so I can make a decision whether to type in any credentials or not.
It should also be mentioned that they certainly aren't actively pushing people to the secure site. You would only get it if you manually typed it in, or are using HTTPS Everywhere.
And the forums, the only place you would actually log in, don't even have a secure version: https://forums.xkcd.com/
Even on Chrome 41 (64b, Win) if you click on the white security indicator it shows a yellow warning triangle and warns you about it using "outdated security settings" which may prevent future versions of chrome from safely accessing it.
It's an aggressive and controversial change - there isn't really much of a reason to reject SHA-1 certificates so early. May be that's why they want to be less alarming at least in the interim.
Edit: installing version 42 does show the red lock, so I guess it's a Canary issue.