Slashdot Mirror
Google Offers Encrypted Web Search Option
alphadogg writes "People who want to shield their use of Google's Web search engine from network snoops now have the option of encrypting the session with SSL protection. In the case of Google search, SSL will protect the transmission of search queries entered by users and the search results returned by Google servers. Google began rolling out the encrypted version of its Web search engine on Friday. 'We think users will appreciate this new option for searching. It's a helpful addition to users' online privacy and security, and we'll continue to add encryption support for more search offerings,' wrote Evan Roseman, a Google software engineer, in an official blog post."
The real reason is that internet hacking people have been figuring out how to monetize the traffic they sniff. This is merely Google reclaiming the market that is rightfully theirs.
It means MITM attacks are more unlikely, but your data is still in Google's hand. Everyone using Google's products should be fully aware of the privacy implications as usual.
In other words, you still trade your privacy for the service provided by Google; the difference is the trade being less likely to be interrupted now.
Colorless green Cthulhu waits dreaming furiously.
Although I concede that this is a good thing, I can't help but question who this feature is for. Surely all the privacy-concious people who want SSL search have already moved to other search engines (given google's questionable record on privacy issues)? SSL will only protect against man-in-the-middle attacks; if anything, it's meaningless privacy theatre.
I must be new here...
They are under fire on G.Streetview in Europe this week, and need to create a lot of goodwill to get things back on track...
This isn't news. Scroogle has been doing this for years and besides security it also adds privacy.
You can also play Pacman now WOHOO!!
I really wanted to know if any site are posting my SSN and CC#. Thanks you, Google.
This could be an interesting development for Google's efforts in China. If the traffic between google and the client is encrypted then the firewall of China *shouldn't* be able to analyse the search results coming back. The only option for China might be to block Google SSL completely but that might be a bit too risky politically.
I'd rather let someone else know what I'm searching something than let Google know that it is me searching it.
In soviet Russia, God creates you!
...thousands of employers begin blocking port 443 to Google ...
WAY UP
The largest prime factor of my UID is 263267.
Most people today probably enter search through their address bars...
That doesnt appear to go through SSL... yet at least.
As a matter of course, we should use SSL on all connections. In some rare cases the computation may be too much of a burden, but in the vast majority of situations it's trivial and there's no reason not to do it.
IMO, the only reason we don't do it more is because the way browsers handle self-signed certificates is broken.
There's no reason for a browser to throw up nasty error dialogs when it encounters a self-signed certificate. Instead, browsers should silently accept such certificates and record the public key fingerprint. Browsers shouldn't turn on the lock icon when using a self-signed cert, or do anything else to make the user think they're browsing on a secure connection, because they're really not, but they should go ahead and encrypt the traffic.
Not only would that provide some measure of security against eavesdropping, but it would also assist with detection of phishing attacks. Browsers could and should throw up nasty warnings/errors when connecting to a site whose certificate has inexplicably changed. This is similar to how SSH handles trust of server keys, a system that works very well in practice.
Regarding this move by Google, I think it's great. I applauded their decision to make Gmail and Google Apps HTTPS-only, and providing the option for Google Search is great, too. Hopefully they'll eventually go to HTTPS-only for search as well. Their page volumes are such that they'll have to seriously consider the impact of the encryption overhead, but I think they'll get there.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
So I just tried https://www.google.co.uk/ and it redirects to unencrypted http://www.google.se/ (.se because that's where ipredator connections show-up as, I guess)
After typing in www.google.com to play some Pac-Man yesterday I was saddened to see the regular logo instead of the game but then I noticed I was at https://www.google.com/. At first I thought all requests to http://.../ were being redirected to https://.../ but after a couple reloads I was back at http://.../ and Pac-Man, and even when I typed in https://.../ it redirected me back to http://./
My question now is, how long until the built-in browser search box in Safari uses this? (I'm sure the one in Firefox can handle this already, or will soon.) Another question: why not use https all the time? I know it's a bit more CPU to encrypt things, which is unnoticeable on modern clients, but how much of a strain is it on servers? Also, are there any popular clients out that don't support it? Is there any reason not to go all https all the time?
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
HTTPS is a joke really, a quick MITM (man in the middle) with ettercap or the like and you can forward the victim a fake SSL certificate when they do an "encrypted" google search and their data will be decrypted as it passes through your man in the middle.
This protects your privacy from everyone but google. Having someone sniff your packets is theoretically possible, but extremely unlikely in reality. On the other hand, you are absolutely guaranteed that google will harvest and store the information from your searches in order to show you ads that they think you'll be interested in. This is why I habitally use the search engine clusty.com for web searches. Clusty's search results usually seem to be about the same quality as google's, and clusty has a better privacy policy.
Find free books.
But google still knows what you did.
---- Booth was a patriot ----
Does anyone know how to adjust Firefox's search bar to use the SSL version of Google?
In other words, you still trade your privacy for the service provided by Google; the difference is the trade being less likely to be interrupted now.
Privacy isn't an all or nothing proposition. I don't "trade in" my privacy, I disclose information selectively. When I search on a search engine, necessarily that search engine know what I searched for. Google has defined retention policies, and there is no reason to believe that they don't comply with them.
However, there are other aspects of privacy I don't have control over. There's a good chance my ISP is sniffing my packets and my government is digging through them to find whatever the political hangup of the day is, and there's a good chance that what ever they are doing, they are doing incompetently.
Now, I'd like to be able to do web searches without having to second guess whether those searches (innocuous and legal as they are) trigger some stupid keyword alert in some badly written network surveillance system. Hence, I like my connections to my search engine to be encrypted.
What Google does with those searches isn't much of a concern for me: there are no known instances of Google doing data mining on behalf of governments (all they do is respond to specific requests), and all they want to do is show me ads.
So, an encrypted connection to Google protects my privacy in exactly the way I want it to: it keeps the people who have no business looking at my web searches from looking at my web searches. Simple, eh?
Looks like google is just mocking DuckDuckGo.
But the use of SSL on google does not offer you privacy: google still knows who you are and what you searched for.
I just don't trust anything that bleeds for five days and doesn't die.
Optimize Google. Sorted.
SSL is available with Scroogle Scraper, and has been for a long time.
https://ssl.scroogle.org/
Unless I'm missing something, this is only for the search itself. As soon as you actually click on of those results, you're at the mercy of whatever server you're connecting to -- and probably no longer encrypted.
Don't thank God, thank a doctor!
Self-signed certificates still protect pretty well against eavesdropping (i.e., passive attacks). They don't protect against MITM attacks. But whether a certificate is self-signed is really irrelevant; even officially signed certificates are not secure against MITM attacks, since certificate authorities can forge them. The organizations likely to be able to pull off a MITM attack on my SSL connections usually can also generate certificates. In different words, there is no reason for me to trust certificate authorities; they do not have my interests at heart.
SSL needs a web of trust and mechanisms like ssh. And with a web of trust, whether something is self-signed or not doesn't matter.
As for Firefox, a simple dialog box should be sufficient; the current multi-step process is idiotic. It makes using legitimate self-signed certificates unnecessarily hard and gives people an excessive level of trust in certificates signed by a CA.
One more technique to add to my sslstrip arsenal :D
but be sure to write down google's ssl fingerprint... and check it every now and then yourself. You never know when your place of work decides to start intercepting https! Mine did recently until I pointed out issues with HIPAA compliance in conjunction with our limited personal use policy! They (work) installed their own certificate on everyone's computers (but they didn't do Firefox which is why i noticed)... and then they modified the proxy servers to start taking a peek before re-encrypting and sending it along :(
This doesn't work with iGoogle yet. Boo.
Also, I'd rather they make encrypted search an account setting or a cookie setting instead of requiring you to go to a separate URL.
the results of your search is encrypted as well, but you do not have the key for interpreting it.
I've been waiting for google to provide a button on their search page "Don't connect this search with my IP address". It's not the me vs my peer privacy that I care about the most, it's the me vs google privacy that scares me.
https://ixquick.com
Encrypted search.
They do not record your IP address
you can access search result pages via their proxy service too.
This will stop nosey people in the middle sniffing my searches.
Is there a way of doing an "advanced search" that only brings up HTTPS results - apart from putting that as a part of the search string?
I'll see your Constitution and raise you a Queen.
While Googles searches are secure, it would appear autosuggests? I use FF's search bar and set the search engine to use SSL. Forcing the autosuggest url to https redirects back to http which means anyone sniffing for suggestqueries.google.com can still find out my queries
[Encryption] would just be down right unforgivable for internet games in terms of ping/lab.
Gaming over Xbox Live Gold is an arguable counterexample to your assertion.
It would be very interesting to see how you think that Google would resolve that problem.
Google could also serve up indirected URLs for everything, essentially providing a caching proxy server to the entire Internet via that SSL connection. If anybody has enough distributed resources to scale that out, it is them.
However, I am more interested in a solution to mask my web activities from Google, than masking my Google activities from the web.
I had to wait a couple minutes, log in using my Google account, and then search for various antispyware-related keywords before Google would let me run a query like this again.
https://www.google.com/search?hl=en&q=slashdot&btnG=Search
Leaking the search keywords in the URL defeats the purpose of a secure search site and still allows ISPs/governments to block results.
I was clearly right, but unfortunately, someone at Slashdot closed the thread I tried to open about this, 6 months ago: http://slashdot.org/submission/1094437/Why-isnt-Google-allowing-searches-over-HTTPS
There's no reason for a browser to throw up nasty error dialogs when it encounters a self-signed certificate. Instead, browsers should silently accept such certificates and record the public key fingerprint. Browsers shouldn't turn on the lock icon when using a self-signed cert, or do anything else to make the user think they're browsing on a secure connection, because they're really not, but they should go ahead and encrypt the traffic.
Security, like everything else, isn't binary, so browsers classifying connections into two classes, "secure" and "insecure" is itself, in some ways, idiocy. We saw this in action recently, when Chinese dissidents were lobbying Mozilla to not trust a certain CA they believe is controlled by the Chinese government.
Your new definition of "secure connection" is still not secure from any adversary who controls or has otherwise subverted an organization trusted to issue certificates. For example, Google itself (I recently noticed, because I've started using Certificate Patrol, that Google juggled some of the certificates it uses for GMail and Google Docs --- perhaps it was because of this new feature --- but all the certificates in question were issued by a CA that Google has set up).
I do understand that Ordinary Joe isn't able to understand all this, and in that context, your suggestion isn't all that bad. I wonder if corporations will start to become so competitive that they will be tempted to abuse their cert-issuing powers to MITM. A possible scenario with less risk to such a corporation would be to use a criminal third party which they have allowed to subvert their CA's security. OTOH, the minute that a corporation would do such a thing, the criminals would have power to MITM any secure browser connection --- one wonders if this would deter such tomfoolery. Actually, one has to wonder whether organized crime hasn't already subverted some CA somewhere, no?
Our Slashdot overlords are killing threads that may make Google look bad? :-)
Not only can they likely tie your computer to the searches but with SSL they know 100% for sure which computer is tied to the searches and from the existing data likely verify better than ever.
No thanks, I'm more concerned with giving Google all this information. I'll stick to using the Google Sharing extension when I have to use Google search or other services and Startpage for general search (no ip logging and done over SSL).
look, i'm all for privacy, but too many expect the impossible
even if google publicly announced it was keeping no logs, this wouldn't be good enough for some people. you'd complain about something, anything. because you want to complain, not because you have anything useful to say
some people's standards are too insane
look: if you go to the store, and buy a can of coke, someone knows you went and bought a can of coke. deal wtih it, that's life: you leak personal info all the time in disjointed ways. there is some exposure you get just for living, your privacy is inherently compromised just by the facts of life, and you just need to be comfortable with it, because a more flexible approach results in benefits, such as being able to use a search engine. yes, you expose your thoughts. yes, you get links to what you want to think about it. its a tradeoff, and its a fundamental one you are not going to get around. so just accept it
look: google's ssl search is WONDERFUL, AMAZING. so celebrate, and be thankful
but no, instead you find something to still complain about, which makes you just another impossible to satisfy whiner, not useful or insightful about anything
realism and practicality trumps naive idealism, on every issue
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
> This protects your privacy from everyone but google.
Wrong. This only protects your privacy from adversaries who cannot afford to subvert CA's. That doesn't include most governments or even most large corporations, and probably doesn't even include organized crime.
Corporate IT will no longer be able to monitor Google search activity merely by intercepting port 80 traffic.
They also cannot implement a webfilter that simply monitors port 80 traffic, and denies your ability to search, based on keyword.
They can't block SSL either, since Google requires SSL for certain things (login to Google accounts, google webmaster tools, google checkout) that Enterprise users may require.
I don't really care about my individual searches being encrypted in transmission.
What about the web search history? Its nice having the history and you can occasionally use it to find stuff later.
I really wish there was an option on that to have it encrypted witch only you could decrypt and not Google.
At the least a way to keep the data locally on your computer and not on a Google server.
and you'll probably still love them when the overthrow the US government. :)
To take advantage of the change in your Firefox search bar on Linux, edit the ~/.mozilla/firefox/xxxxxx.default/search.json file and change all URL references to Google to "https" where xxxxxx is the random string created by Firefox. I assume it's similar for other operating systems.
While this is a step i nthe right direction, I believe only the results of your search are encrypted, not the search string itself. Perhaps Google should make the search a POST and not a GET. That should solve the problem of your search string appearing in the URL.
I tried googling for a plugin to the search bar but to no avail. Do anyone know away to fix that?
Petname helps verifying that the SSL certificate is the same you found earlier.
__
Men with no respect for life must never be allowed to control the ultimate instruments of death.
GW Bu
I ask because when I tried to edit google.xml in my searchplugins folder, I found that there's suggestqueries.google.com (or something like that... I'm working from memory here) that doesn't speak SSL (it redirects you to non-SSL Google).
Mind you, I eventually installed exactly that plugin, but I still don't know everything it's doing.
They add SSL to their existing service and think it requires a "beta" tag? Really?
It's about what you do with them.
Yes, I realize the Google page showing you a list of results is secure. However, the instant you actually click on one of those results -- say, Slashdot -- you're probably not on SSL anymore (most of the Internet isn't), and your Referer header will tell anyone listening exactly what search terms you used to get there.
Don't thank God, thank a doctor!
Private Browsing with Firefox + encrypted google search = undetectable nsfw google image search
... if Gmail, Hotmail, and Yahoo implemented PGP for their web-access email, we could start to actually communicate with each other securely, too.
https://addons.mozilla.org/en-US/firefox/search/?q=google+https&cat=4%2C0&appid=1&lver=any&atype=0&sort=&pid=1&pp=20&lup=&advanced=
Secure Google Search
https://addons.mozilla.org/en-US/firefox/addon/161897/
Not sure that the add on isn't MITMing me, but at least it limits it to google and the add on makers.
And if it also prevents man in the middle hacking of web pages it's a good thing.
There has been some debate as to whether HTTPS should become the default for web sites. It would prevent all kinds of misdeeds, from sniffing and MITM on free Wifi networks to ISPs sniffing or "enhancing" the pages we view by injecting code. In the case of ISPs it allows them to eventually out-compete the independent sites we like.
But with a ubiquitous jumping-off point like Google serving up search results in HTTPS, it may influence other and varied websites to offer the same kind of connection.
Google's decision could have some positive knock-on effects... Or with Symantec buying Verisign, maybe not!
At last week's Oakland conference (a.k.a. the IEEE Symposium on Security and Privacy), a team of researchers from MSR demonstrated that the auto-complete features of many web sites (including Google search) reveal individual keystrokes based on the size of the returned auto-complete lists. They demonstrated this over WPA2, but I have no reason to believe it wouldn't work over HTTPS.
Separately, it was also pointed out that the root certificates for Google's HTTPS site use MD2 and 1024-bit RSA keys.
Several OSS let you install your own websearch proxy, like http://www.googlesharing.com/ and http://www.seeks-project.info/ Add SSL to it and you get your own scroogle. Alternatively you can also use that by others such as friends, building up a network of trusted websearch proxies.
1. Options->Basics->Default Search->Manage
2. Click Add
3. Fill in some Name/Keyword (doesn't matter, just make it unique/descriptive)
4. Set URL field to: https://www.google.com/search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q=%s
5. Click Ok
6. Optional: Click "Make Default" button
Enjoy!
As others have pointed out, there is no encrypted autocomplete, so I decided to make a separate Google search entry without it. Oddly enough Google SSL was redirecting to non-SSL (for me, at least) between about 11AM-12:30PM EST. Since it is back now, however, you may find this xml useful; you might find it a lot more useful if I just put in a link, but alas my domain is my real name...
/>
You might also have to convert the image to ico again (or just choose your own). If you copy [opensearch.xml] into some local xml file, and then link to it with [addsearch.html] (replacing the path, obviously), it is very easy to add to Firefox (or IE, I guess) without mucking around with json files. An option to add it will appear at the bottom of the provider dropdown menu.
[addsearch.html]
<html><head>
<link rel="search" type="application/opensearchdescription+xml" href="[opensearch.xml]" title="Google SSL"/>
</head></html>
[opensearch.xml]
<OpenSearchDescription xmlns="http://www.opensearch.org/Specifications/OpenSearch/1.1">
<ShortName>Google SSL</ShortName>
<LongName>Google SSL Web Search</LongName>
<Description>Search Google using SSL Encryption (no suggestions)</Description>
<Url type="text/html" method="GET" template="https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t"
<Image height="16" width="16" type="image/png">http://img189.imageshack.us/img189/827/lockicon.png</Image>
<Language>en-us</Language>
<Language>*</Language>
<InputEncoding>UTF-8</InputEncoding>
<OutputEncoding>UTF-8</OutputEncoding>
</OpenSearchDescription>
Thats one of the funniest things I have seen in a long time. Google indexes all your searches and other data and even listens to your PC microphone, then hands that all over to the NSA. Why do you think the Google monopoly machine is allowed to dominate , just like the Microsoft monopoly it is Government supported via a quid-pro-quo arangement.
Research the NWO or Global Government if you want to see what those of so called power are really up to in the world.
You had better Wake Up Soon you don't have much time left.
But no other walls or roof.
That’s exactly what this is.
It’s like Facebook encrypting the http connection.
When it reaches the server, it is still sold off to everyone who pays money.
Any sufficiently advanced intelligence is indistinguishable from stupidity.
that is, until they lose your trust too.