diff --git a/lib/units/device/plugins/browser.js b/lib/units/device/plugins/browser.js
index 7d869ba8..07bbda0e 100644
--- a/lib/units/device/plugins/browser.js
+++ b/lib/units/device/plugins/browser.js
@@ -67,9 +67,17 @@ module.exports = syrup.serial()
         .then(updateBrowsers)
     }
 
+    function ensureHttpProtocol(url) {
+      // Check for '://' because a protocol-less URL might include
+      // a username:password combination.
+      return (url.indexOf('://') === -1 ? 'http://' : '') + url
+    }
+
     service.on('browserPackageChange', updateBrowsers)
 
     router.on(wire.BrowserOpenMessage, function(channel, message) {
+      message.url = ensureHttpProtocol(message.url)
+
       if (message.browser) {
         log.info('Opening "%s" in "%s"', message.url, message.browser)
       }
diff --git a/res/app/control-panes/dashboard/navigation/navigation-controller.js b/res/app/control-panes/dashboard/navigation/navigation-controller.js
index 4e837329..390bb072 100644
--- a/res/app/control-panes/dashboard/navigation/navigation-controller.js
+++ b/res/app/control-panes/dashboard/navigation/navigation-controller.js
@@ -24,10 +24,9 @@ module.exports = function NavigationCtrl($scope, $rootScope) {
   }
 
   function addHttp(textUrl) {
-    if (textUrl.indexOf(':') === -1 && textUrl.indexOf('.') !== -1) {
-      return 'http://' + textUrl
-    }
-    return textUrl
+    // Check for '://' because a protocol-less URL might include
+    // a username:password combination.
+    return (textUrl.indexOf('://') === -1 ? 'http://' : '') + textUrl
   }
 
   $scope.blurUrl = false