Slashdot Mirror
Google Offers Encrypted Web Search Option
alphadogg writes "People who want to shield their use of Google's Web search engine from network snoops now have the option of encrypting the session with SSL protection. In the case of Google search, SSL will protect the transmission of search queries entered by users and the search results returned by Google servers. Google began rolling out the encrypted version of its Web search engine on Friday. 'We think users will appreciate this new option for searching. It's a helpful addition to users' online privacy and security, and we'll continue to add encryption support for more search offerings,' wrote Evan Roseman, a Google software engineer, in an official blog post."
The real reason is that internet hacking people have been figuring out how to monetize the traffic they sniff. This is merely Google reclaiming the market that is rightfully theirs.
In other words, you still trade your privacy for the service provided by Google; the difference is the trade being less likely to be interrupted now.
Google has never shown any tendency towards abuse of my private data. My government, on the other hand, has repeatedly demonstrated its willingness to break its own laws whenever it's convenient for any of their actual constituents, i.e. corporations. I'm much more worried about my government watching my search history than google doing it. Of course, they'll give that information to my government any old time, but that's not the same thing as having it continually logged where it can fire off triggers.
No, I'm not doing anything that I feel my government would attack me for. But then, I'm not doing anything google would attack me for, either. Google continually stands in opposition to the corporations that I am concerned about. The enemy of my enemy may or may not be my friend, but odds are better than if he's my enemy's friend. Contrarily, much of what the U.S. government does makes it the enemy of any right-thinking citizen, where right-thinking is defined as "freedom-loving". (I may have a bias, but I certainly don't hide it.)
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
This isn't news. Scroogle has been doing this for years and besides security it also adds privacy.
I agree it's a theater, making people feel more secure somehow.
But there are many opportunities for MitM attacks for Google queries, and making those harder does make sense.
Truth arises more readily from error than from confusion. -Francis Bacon
I really wanted to know if any site are posting my SSN and CC#. Thanks you, Google.
This could be an interesting development for Google's efforts in China. If the traffic between google and the client is encrypted then the firewall of China *shouldn't* be able to analyse the search results coming back. The only option for China might be to block Google SSL completely but that might be a bit too risky politically.
SSL adds protection to both ends of the communication. This may look like a circus from the user's perspective; but for Google themselves, it's better self-defense.
Colorless green Cthulhu waits dreaming furiously.
I'd rather let someone else know what I'm searching something than let Google know that it is me searching it.
In soviet Russia, God creates you!
...thousands of employers begin blocking port 443 to Google ...
At least it's nice for Google users in China like me. The government has been actively disrupting Google's service in mainland China since they moved to Hong Kong, restting your connection if certain words/characters (yes characters!) are detected. An encrypted connection surely makes using Google in China less painful.
Most people today probably enter search through their address bars...
That doesnt appear to go through SSL... yet at least.
My government, on the other hand, has repeatedly demonstrated its willingness to break its own laws whenever it's convenient for any of their actual constituents, i.e. corporations.
You do realize that Google is a corporation too, don't you?
The largest prime factor of my UID is 263267.
As a matter of course, we should use SSL on all connections. In some rare cases the computation may be too much of a burden, but in the vast majority of situations it's trivial and there's no reason not to do it.
IMO, the only reason we don't do it more is because the way browsers handle self-signed certificates is broken.
There's no reason for a browser to throw up nasty error dialogs when it encounters a self-signed certificate. Instead, browsers should silently accept such certificates and record the public key fingerprint. Browsers shouldn't turn on the lock icon when using a self-signed cert, or do anything else to make the user think they're browsing on a secure connection, because they're really not, but they should go ahead and encrypt the traffic.
Not only would that provide some measure of security against eavesdropping, but it would also assist with detection of phishing attacks. Browsers could and should throw up nasty warnings/errors when connecting to a site whose certificate has inexplicably changed. This is similar to how SSH handles trust of server keys, a system that works very well in practice.
Regarding this move by Google, I think it's great. I applauded their decision to make Gmail and Google Apps HTTPS-only, and providing the option for Google Search is great, too. Hopefully they'll eventually go to HTTPS-only for search as well. Their page volumes are such that they'll have to seriously consider the impact of the encryption overhead, but I think they'll get there.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Thank you captain obvious. Any more insightful commentary for us?
Odd != Even?
The whole in my donut is still missing?
Time + Materials != the portmanteau 'Timaterials'?
So I just tried https://www.google.co.uk/ and it redirects to unencrypted http://www.google.se/ (.se because that's where ipredator connections show-up as, I guess)
Just so you know, they use 128-bit RC4 encryption, which is considered insecure. Today AES-256 is standard.
My government, on the other hand, has repeatedly demonstrated its willingness to break its own laws whenever it's convenient for any of their actual constituents, i.e. corporations.
[...]
No, I'm not doing anything that I feel my government would attack me for. But then, I'm not doing anything google would attack me for, either. Google continually stands in opposition to the corporations that I am concerned about. The enemy of my enemy may or may not be my friend, but odds are better than if he's my enemy's friend.
You do realize that Google is a corporation too, don't you?
You just failed your CTBS reading comprehension test. Back to elementary school with you! (If you are in elementary school now, I apologize. I do not want to be ageist.)
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
After typing in www.google.com to play some Pac-Man yesterday I was saddened to see the regular logo instead of the game but then I noticed I was at https://www.google.com/. At first I thought all requests to http://.../ were being redirected to https://.../ but after a couple reloads I was back at http://.../ and Pac-Man, and even when I typed in https://.../ it redirected me back to http://./
My question now is, how long until the built-in browser search box in Safari uses this? (I'm sure the one in Firefox can handle this already, or will soon.) Another question: why not use https all the time? I know it's a bit more CPU to encrypt things, which is unnoticeable on modern clients, but how much of a strain is it on servers? Also, are there any popular clients out that don't support it? Is there any reason not to go all https all the time?
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
This protects your privacy from everyone but google. Having someone sniff your packets is theoretically possible, but extremely unlikely in reality. On the other hand, you are absolutely guaranteed that google will harvest and store the information from your searches in order to show you ads that they think you'll be interested in. This is why I habitally use the search engine clusty.com for web searches. Clusty's search results usually seem to be about the same quality as google's, and clusty has a better privacy policy.
Find free books.
But google still knows what you did.
---- Booth was a patriot ----
No, I'm not doing anything that I feel my government would attack me for.
Today perhaps. The rules can change tomorrow.
---- Booth was a patriot ----
Does anyone know how to adjust Firefox's search bar to use the SSL version of Google?
In other words, you still trade your privacy for the service provided by Google; the difference is the trade being less likely to be interrupted now.
Privacy isn't an all or nothing proposition. I don't "trade in" my privacy, I disclose information selectively. When I search on a search engine, necessarily that search engine know what I searched for. Google has defined retention policies, and there is no reason to believe that they don't comply with them.
However, there are other aspects of privacy I don't have control over. There's a good chance my ISP is sniffing my packets and my government is digging through them to find whatever the political hangup of the day is, and there's a good chance that what ever they are doing, they are doing incompetently.
Now, I'd like to be able to do web searches without having to second guess whether those searches (innocuous and legal as they are) trigger some stupid keyword alert in some badly written network surveillance system. Hence, I like my connections to my search engine to be encrypted.
What Google does with those searches isn't much of a concern for me: there are no known instances of Google doing data mining on behalf of governments (all they do is respond to specific requests), and all they want to do is show me ads.
So, an encrypted connection to Google protects my privacy in exactly the way I want it to: it keeps the people who have no business looking at my web searches from looking at my web searches. Simple, eh?
I doubt it's meant to prevent a government from breaking into a specific connection, or things like that. If your government wanted to do that, they might also break into your computer remotely & install a keylogger. Governments have resources to pull that kind of crap.
It's more likely meant to prevent large scale snooping on Google traffic, for marketing or other (political?) purposes. And for that purpose, any encryption is strong enough when it makes breaking into connections expensive enough (as in: not worth the effort). I'd guess the bright folks over at Google have determined RC4 128-bit good enough for that purpose.
Looks like google is just mocking DuckDuckGo.
But the use of SSL on google does not offer you privacy: google still knows who you are and what you searched for.
I just don't trust anything that bleeds for five days and doesn't die.
(given google's questionable record on privacy issues)?
Really? Like what?
moved to other search engines
Like which one? Bing? What reason do I have to trust them any more than Google?
I can't help but question who this feature is for.
Pretty much anybody. Right now, your ISP and your government likely are scanning your unencrypted web communications for keywords and prohibited content. Even if you don't do anything wrong, you may trigger those systems, with potentially unpleasant consequences. An SSL connection makes that harder for them.
And it's a matter of principle: my web searches are nobody's business other than my own and my search engine's.
SSL will only protect against man-in-the-middle attacks;
SSL protects against eavesdropping.
Unless I'm missing something, this is only for the search itself. As soon as you actually click on of those results, you're at the mercy of whatever server you're connecting to -- and probably no longer encrypted.
Don't thank God, thank a doctor!
Self-signed certificates still protect pretty well against eavesdropping (i.e., passive attacks). They don't protect against MITM attacks. But whether a certificate is self-signed is really irrelevant; even officially signed certificates are not secure against MITM attacks, since certificate authorities can forge them. The organizations likely to be able to pull off a MITM attack on my SSL connections usually can also generate certificates. In different words, there is no reason for me to trust certificate authorities; they do not have my interests at heart.
SSL needs a web of trust and mechanisms like ssh. And with a web of trust, whether something is self-signed or not doesn't matter.
As for Firefox, a simple dialog box should be sufficient; the current multi-step process is idiotic. It makes using legitimate self-signed certificates unnecessarily hard and gives people an excessive level of trust in certificates signed by a CA.
but be sure to write down google's ssl fingerprint... and check it every now and then yourself. You never know when your place of work decides to start intercepting https! Mine did recently until I pointed out issues with HIPAA compliance in conjunction with our limited personal use policy! They (work) installed their own certificate on everyone's computers (but they didn't do Firefox which is why i noticed)... and then they modified the proxy servers to start taking a peek before re-encrypting and sending it along :(
Google clearly states this on their page. There is no such thing as 'free'.
"few notes to remember: Google will still maintain search data to improve your search quality and to provide better service. Searching over SSL doesn't reduce the data sent to Google -- it only hides that data from third parties who seek it. And clicking on any of the web results, including Google universal search results for unsupported services like Google Images, could take you out of SSL mode. Our hope is that more websites and services will add support for SSL to help create a better and more consistent experience for you.
We think users will appreciate this new option for searching. It's a helpful addition to users' online privacy and security, and we'll continue to add encryption support for more search offerings. To learn more about using the feature, refer to our help article on search over SSL."
They make there money by monetizing your search and with ads. You are free not to use their service.
Veramocor
Google definitely uses my data in ways that I don't explicitly authorize them to (arguably it is embedded in one of those terms of service that i sign but I am not talking technicality here but perception of trust) and definitely creates suspicion on total transparency image that is often spread in this forum. I have posted my experience below.
http://diagonalslash.blogspot.com/2010/05/google-is-messing-with-my-profile-data.html
Google has never shown any tendency towards abuse of my private data...Of course, they'll give that information to my government any old time, but that's not the same thing as having it continually logged where it can fire off triggers.
How do you know it's not being done automatically now? You don't.. My advice is simply to trust no one. The internet is a party line, any anybody can hear what you're doing. And government and corporation are the same. That's the way the majority wants it. The cool thing is that you can vote in a different government if you like. You don't have to vote for your spoon fed candidates if you don't want to. That means the problem is your friends and neighbors, not the government itself. It takes a bit more effort to drive a corporation into bankruptcy. Wall Street has turned that into a game of whack-a-mole.
“He’s not deformed, he’s just drunk!”
This doesn't work with iGoogle yet. Boo.
Also, I'd rather they make encrypted search an account setting or a cookie setting instead of requiring you to go to a separate URL.
They won't reset it if they detect an encrypted connection? Because I sure would if I was the blue meanie in charge...
“He’s not deformed, he’s just drunk!”
I've been waiting for google to provide a button on their search page "Don't connect this search with my IP address". It's not the me vs my peer privacy that I care about the most, it's the me vs google privacy that scares me.
https://ixquick.com
Encrypted search.
They do not record your IP address
you can access search result pages via their proxy service too.
This will stop nosey people in the middle sniffing my searches.
Is there a way of doing an "advanced search" that only brings up HTTPS results - apart from putting that as a part of the search string?
I'll see your Constitution and raise you a Queen.
While Googles searches are secure, it would appear autosuggests? I use FF's search bar and set the search engine to use SSL. Forcing the autosuggest url to https redirects back to http which means anyone sniffing for suggestqueries.google.com can still find out my queries
[Encryption] would just be down right unforgivable for internet games in terms of ping/lab.
Gaming over Xbox Live Gold is an arguable counterexample to your assertion.
I had to wait a couple minutes, log in using my Google account, and then search for various antispyware-related keywords before Google would let me run a query like this again.
128-bit RC4 as used in SSL/TLS is not necessarily insecure. I know of no situation where the crypto has been directly broken in practice. Certain RC4-based systems, like WEP, have been broken in part due to flaws in RC4 but also from poor implementation. RC4 as used in HTTPS is still quite secure, even though AES is preferred. RC4 HTTPS seems completely acceptable for protecting most user's Google search terms. It has been successfully used to protect far more sensitive information.
It only needs to be good enough to make wide-scale interception expensive, and it needs to be as fast as possible. Remember Google has a lot of traffic, and SSH is not free in terms of bandwidth and processor usage, not even after the initial handshake.
"I think I am a fallen star. I should wish on myself."
I was clearly right, but unfortunately, someone at Slashdot closed the thread I tried to open about this, 6 months ago: http://slashdot.org/submission/1094437/Why-isnt-Google-allowing-searches-over-HTTPS
There's no reason for a browser to throw up nasty error dialogs when it encounters a self-signed certificate. Instead, browsers should silently accept such certificates and record the public key fingerprint. Browsers shouldn't turn on the lock icon when using a self-signed cert, or do anything else to make the user think they're browsing on a secure connection, because they're really not, but they should go ahead and encrypt the traffic.
Security, like everything else, isn't binary, so browsers classifying connections into two classes, "secure" and "insecure" is itself, in some ways, idiocy. We saw this in action recently, when Chinese dissidents were lobbying Mozilla to not trust a certain CA they believe is controlled by the Chinese government.
Your new definition of "secure connection" is still not secure from any adversary who controls or has otherwise subverted an organization trusted to issue certificates. For example, Google itself (I recently noticed, because I've started using Certificate Patrol, that Google juggled some of the certificates it uses for GMail and Google Docs --- perhaps it was because of this new feature --- but all the certificates in question were issued by a CA that Google has set up).
I do understand that Ordinary Joe isn't able to understand all this, and in that context, your suggestion isn't all that bad. I wonder if corporations will start to become so competitive that they will be tempted to abuse their cert-issuing powers to MITM. A possible scenario with less risk to such a corporation would be to use a criminal third party which they have allowed to subvert their CA's security. OTOH, the minute that a corporation would do such a thing, the criminals would have power to MITM any secure browser connection --- one wonders if this would deter such tomfoolery. Actually, one has to wonder whether organized crime hasn't already subverted some CA somewhere, no?
Our Slashdot overlords are killing threads that may make Google look bad? :-)
look, i'm all for privacy, but too many expect the impossible
even if google publicly announced it was keeping no logs, this wouldn't be good enough for some people. you'd complain about something, anything. because you want to complain, not because you have anything useful to say
some people's standards are too insane
look: if you go to the store, and buy a can of coke, someone knows you went and bought a can of coke. deal wtih it, that's life: you leak personal info all the time in disjointed ways. there is some exposure you get just for living, your privacy is inherently compromised just by the facts of life, and you just need to be comfortable with it, because a more flexible approach results in benefits, such as being able to use a search engine. yes, you expose your thoughts. yes, you get links to what you want to think about it. its a tradeoff, and its a fundamental one you are not going to get around. so just accept it
look: google's ssl search is WONDERFUL, AMAZING. so celebrate, and be thankful
but no, instead you find something to still complain about, which makes you just another impossible to satisfy whiner, not useful or insightful about anything
realism and practicality trumps naive idealism, on every issue
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
> This protects your privacy from everyone but google.
Wrong. This only protects your privacy from adversaries who cannot afford to subvert CA's. That doesn't include most governments or even most large corporations, and probably doesn't even include organized crime.
Corporate IT will no longer be able to monitor Google search activity merely by intercepting port 80 traffic.
They also cannot implement a webfilter that simply monitors port 80 traffic, and denies your ability to search, based on keyword.
They can't block SSL either, since Google requires SSL for certain things (login to Google accounts, google webmaster tools, google checkout) that Enterprise users may require.
and you'll probably still love them when the overthrow the US government. :)
Well, yeah, the queries you actively send to Google are in Google's hands.
The privacy benefit is directly linked to the security benefit, in that people other than the one to whom you are choosing to give your data to provide you with a service don't have quite as easy access to it in transit.
Privacy doesn't mean no one has your information, it means that only the people you choose to give your information to have it.
To take advantage of the change in your Firefox search bar on Linux, edit the ~/.mozilla/firefox/xxxxxx.default/search.json file and change all URL references to Google to "https" where xxxxxx is the random string created by Firefox. I assume it's similar for other operating systems.
While this is a step i nthe right direction, I believe only the results of your search are encrypted, not the search string itself. Perhaps Google should make the search a POST and not a GET. That should solve the problem of your search string appearing in the URL.
depends, if I trust google with my data, and not my ISP or their upstream or the upstreams upstream and up and up.
All of the above was encrypted with a Quad ROT-13 method. Unauthorized decryption is in violation of the DMCA.
I tried googling for a plugin to the search bar but to no avail. Do anyone know away to fix that?
Petname helps verifying that the SSL certificate is the same you found earlier.
__
Men with no respect for life must never be allowed to control the ultimate instruments of death.
GW Bu
Who is this for?
Yeah! There's no Pac-Man in SSL'd google.com!
They add SSL to their existing service and think it requires a "beta" tag? Really?
It's about what you do with them.
Yes, I realize the Google page showing you a list of results is secure. However, the instant you actually click on one of those results -- say, Slashdot -- you're probably not on SSL anymore (most of the Internet isn't), and your Referer header will tell anyone listening exactly what search terms you used to get there.
Don't thank God, thank a doctor!
SSL is extremely transient.
Sig Battery depleted. Reverting to safe mode.
And if it also prevents man in the middle hacking of web pages it's a good thing.
There has been some debate as to whether HTTPS should become the default for web sites. It would prevent all kinds of misdeeds, from sniffing and MITM on free Wifi networks to ISPs sniffing or "enhancing" the pages we view by injecting code. In the case of ISPs it allows them to eventually out-compete the independent sites we like.
But with a ubiquitous jumping-off point like Google serving up search results in HTTPS, it may influence other and varied websites to offer the same kind of connection.
Google's decision could have some positive knock-on effects... Or with Symantec buying Verisign, maybe not!
RC4 is known to have weaknesses if used incorrectly. That is not the same as being "insecure".
RC4 is vulnerable to snooping in the same sense that airplanes are vulnerable to terrorists. In theory something bad can happen if someone malicious gets very lucky and a large number of people fail to do their jobs properly, but in practice it's really not something that should be keeping you awake at night.
I expect the reason Google prefers RC4 over AES is that RC4 is considerably cheaper.
At last week's Oakland conference (a.k.a. the IEEE Symposium on Security and Privacy), a team of researchers from MSR demonstrated that the auto-complete features of many web sites (including Google search) reveal individual keystrokes based on the size of the returned auto-complete lists. They demonstrated this over WPA2, but I have no reason to believe it wouldn't work over HTTPS.
Separately, it was also pointed out that the root certificates for Google's HTTPS site use MD2 and 1024-bit RSA keys.
I'm sure Google doesn't want to use the more resource intensive AES-256 encryption for search page instead of the much faster RC4 algorithm. s sufficient enough. It's considered insecure because there are a few implementation exploits for it (like WEP) but the algorithm itself is sound. I'm sure it would take long enough to crack the 3.4 * 10E38 possible key combinations.
The clash of honour calls, to stand when others fall.
Why wait for someone to show up for the need for gov sneak and peek.
Just get your Certificate Authorities to mix and match some local magic and ssl becomes plaintext.
Domestic spying is now "Benign Information Gathering"
Several OSS let you install your own websearch proxy, like http://www.googlesharing.com/ and http://www.seeks-project.info/ Add SSL to it and you get your own scroogle. Alternatively you can also use that by others such as friends, building up a network of trusted websearch proxies.
1. Options->Basics->Default Search->Manage
2. Click Add
3. Fill in some Name/Keyword (doesn't matter, just make it unique/descriptive)
4. Set URL field to: https://www.google.com/search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q=%s
5. Click Ok
6. Optional: Click "Make Default" button
Enjoy!
This COULD be the last search they ever see from you.
"Gratuitous complexity is akin to chaos" - True Vox
As others have pointed out, there is no encrypted autocomplete, so I decided to make a separate Google search entry without it. Oddly enough Google SSL was redirecting to non-SSL (for me, at least) between about 11AM-12:30PM EST. Since it is back now, however, you may find this xml useful; you might find it a lot more useful if I just put in a link, but alas my domain is my real name...
/>
You might also have to convert the image to ico again (or just choose your own). If you copy [opensearch.xml] into some local xml file, and then link to it with [addsearch.html] (replacing the path, obviously), it is very easy to add to Firefox (or IE, I guess) without mucking around with json files. An option to add it will appear at the bottom of the provider dropdown menu.
[addsearch.html]
<html><head>
<link rel="search" type="application/opensearchdescription+xml" href="[opensearch.xml]" title="Google SSL"/>
</head></html>
[opensearch.xml]
<OpenSearchDescription xmlns="http://www.opensearch.org/Specifications/OpenSearch/1.1">
<ShortName>Google SSL</ShortName>
<LongName>Google SSL Web Search</LongName>
<Description>Search Google using SSL Encryption (no suggestions)</Description>
<Url type="text/html" method="GET" template="https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t"
<Image height="16" width="16" type="image/png">http://img189.imageshack.us/img189/827/lockicon.png</Image>
<Language>en-us</Language>
<Language>*</Language>
<InputEncoding>UTF-8</InputEncoding>
<OutputEncoding>UTF-8</OutputEncoding>
</OpenSearchDescription>
But no other walls or roof.
That’s exactly what this is.
It’s like Facebook encrypting the http connection.
When it reaches the server, it is still sold off to everyone who pays money.
Any sufficiently advanced intelligence is indistinguishable from stupidity.
that is, until they lose your trust too.