tools/metrics/histograms/histograms.xml

Index: tools/metrics/histograms/histograms.xml
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 94ac7b1e3e03dc6258aa53fd429f47c5983a1a15..7ff4b094b109064da8269c960a1488e552cd2892 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -44473,6 +44473,18 @@ http://cs/file:chrome/histograms.xml - but prefer this file for new entries.
   </summary>
 </histogram>
 
+<histogram
+    name="PasswordManager.ShouldBlockPasswordForSameOriginButDifferentScheme"
+    enum="BooleanBlocked">
+  <owner>jdoerrie@chromium.org</owner>
+  <summary>
+    Records whether a credential submission was blocked due to a previous
+    submission from a URL with the same origin but a different and insecure
+    scheme. More details can be found in the doc associated with
+    http://crbug.com/571580.

[Ilya Sherman, 2017/01/12 00:52:04]

Reading this description, I'm still somewhat confused as to what exactly is
being measured here.  I understand that there might be a need to be a bit
circumspect so as to not spell out a potential attack vector, but I think this
metric could still be clarified within those bounds.  In particular, I'd
recommend (1) documenting exactly when this metric is recorded, and (2) using
multiple, shorter sentences to explain what is being measured.  For example,
something along the lines of:

"This metric is recorded every time Chrome detects a new credential submitted
via a form hosted on a secure scheme.  The credential might be saved, or it
might be blocked.  It is blocked if Chrome has previously detected [or maybe
currently has stored?] any credentials from a URL with the same origin, but a
different and insecure scheme.  That is, if there is already a credential saved
for http://example.com, a new credential for https://example.com would be
blocked."

(I'm not sure whether the description I proposed is fully accurate, but
hopefully it conveys the idea.)

+  </summary>
+</histogram>
+
 <histogram name="PasswordManager.ShouldShowAutoSignInFirstRunExperience"
     enum="BooleanPending">
   <owner>vasilii@chromium.org</owner>