Slashdot Mirror
Google Will Give a Search Edge To Websites That Use Encryption
As TechCrunch reports, Google will begin using website encryption, or HTTPS, as a ranking signal – a move which should prompt website developers who have dragged their heels on increased security measures, or who debated whether their website was “important” enough to require encryption, to make a change. Initially, HTTPS will only be a lightweight signal, affecting fewer than 1% of global queries, says Google. ... Over time, however, encryption’s effect on search ranking [may] strengthen, as the company places more importance on website security. ... While HTTPS and site encryption have been a best practice in the security community for years, the revelation that the NSA has been tapping the cables, so to speak, to mine user information directly has prompted many technology companies to consider increasing their own security measures, too. Yahoo, for example, also announced in November its plans to encrypt its data center traffic.
That's a really great step from Google, I had never thought that it can be done in such a neat way. What's next? Can they also do it for IPv6?
I'm not convinced that this is a good precedent. Sure, they're encouraging sites to use HTTPS today... but what about tomorrow?
Speculation: Websites that block competing search engines from indexing their content may rank higher in Google searches? Websites that process payments using Google rank higher in Google search?
I'm not saying that HTTPS is a bad thing... but once they open the door once to arbitrary ranking changes done on a whim, that door can be opened again.
i, Google, (corporations are legal individuals in USA) refuse to rank my response due to it's incriminating nature.
Expensive advertising campaigns engender trust because it shows that the advertiser has the resources to carry out the campaign. It's why online ads are so commonly ignored - people want to do business with "reputable" companies and expensive advertising is a way of establishing repute.
Similarly, putting out the modicum of effort to perform basic security like SSL is a signal that the website is reputable. I mean, if you can't be bothered to buy a $50 SSL certificate and install it, are you *really* trustworthy?
SSL should be a basic signal of trustworthiness.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Thanks to Google for making the web a little bit more secure by promoting secure websites!
Thanks to the NSA for tapping the web so blindly and boldly than we should react!
If the NSA was not so bold and had tapped only these who were under suspicion of bad behavior, the status-quo would have been kept. Now the privacy of everyone is a little bit more secure and the NSA will have a little bit harder times managing MITM attacks on every netizens.
An EU Citizen who like its privacy.
So my cat picture blog will rank lower than a competitor's SSL encrypted cat picture blog, even though neither of us require you to log in or even prove you are a cat?
HTTPS supports client certificates, but very few sites require them because popular browsers still make them more difficult for a less-trained user to manage than passwords.
You're thinking of client certificates. You're able to remove them just like you can remove cookies, though getting a client certificate requires agreeing and clicking through a dialog, so they're strictly worse than cookies for tracking people who don't want to be tracked.
I have no technical problem switching every website/server I have to SSL but the actual problem is the price of all those SSL certs. Most of my sites are just hobby type sites that I run for my own enjoyment and to benefit others (quite a few "others" I should mention; some of my sites are very popular). However, I don't make any money off these, in fact it already costs me money to run them.
Now you want me to add SSL so that people can still find my relevant and useful information? Well, OK but how the hell am I suppose to pay for it? SSL server certs are expensive. The whole thing is a scam to make the few "official" CA's rich. How about some sort of official public service that can hand out server certs of every registered domain? Every domain should come with an unlimited supply of SSL certs or at least a wildcard cert and a renewal service, free of charge.
The ratio of people to cake is too big
I mean, if you can't be bothered to buy a $50 SSL certificate and install it, are you *really* trustworthy?
It's not only the cost of a certificate, which StartSSL provides without charge to individuals. It's also a dedicated IPv4 address if you want to reach people still using Android 2 or Windows XP. A lot of entry-level hosting packages use name-based virtual hosting, and doing this over name-based virtual hosting requires the TLS stack to support Server Name Indication (SNI). Android Browser didn't gain support for SNI until Honeycomb (3.x) on tablets and ICS (4.0) on phones, and Internet Explorer didn't gain support for SNI until Windows Vista.
It's ironic that I'm hearing about this story on Slashdot, a site that has so far refused any sort of security. Good luck on your page ranks Slashdot.
StartSSL uses client certificates to identify subscribers.
How about some sort of official public service that can hand out server certs of every registered domain?
You mean like StartSSL? Or what about DANE, which stores TLS certificates in DNSSEC?
Googlebot doesn't know the username and password to your real FTP server. What e-mail address should it be using for anonymous FTP?
Slashdot makes HTTPS available only to subscribers because historically, web ad networks haven't supported HTTPS. Only in September 2013 did Google AdSense roll out HTTPS support.
Are sites with ads considered "commercial sites"? The operator of SiteTruth seems to think so.
SSL requires a dedicated IP
Only if your clients include Android 2.x or Internet Explorer on Windows XP. Every other browser that matters supports Server Name Indication (SNI), which allows name-based virtual hosting to work through TLS. As of today, if you can see my site without certificate errors, your browser supports SNI.
and an extra charge
StartSSL issues certificates to individuals without charge.
Is there really a privacy concern if my visit to a weather site, a dictionary, or other factual content site is not encrypted?
Yes. Someone could copy and replay the session ID linked to your user account on the site and gain your privileges.
Then there's the bandwidth issue. Sites that go SSlL will use more bandwidth
What in TLS introduces this substantial extra overhead? And how much overhead is it, really? I do know of a common misconception that HTTPS isn't cacheable. In fact, a document delivered through HTTPS is cached on the client the same way anything else is cached on the client. It just isn't cached on an intermediate transparent proxy, which hurts if your ISP is using such a proxy to cut down on its own upstream.
StartSSL and SNI work out of the box for the majority. Or if this site gives you certificate errors, which browser are you using?
So now only Google/Facebook/twitter/... will know what you so on the Web... thanks to the omnipresent social buttons, to cookies, to google analytics, to google adwords, etc.etc. Smart move... clearly to protect MY privacy...
And is the one and only time I've ever needed to use a client certificate in the browser.
I want my search engine to return the most relevant results, not engage in activism.
Isn't it unfair to rank content based on encryption rather than relevance? What do you say?
I myself would promote HTTPS sites with a golden lock symbol and a text "This site transmits your data confidentially".
None of the leaked documents from Snowden appear to mention compromised CA's, or at least no kind of compromise at scale. This is most likely because (1) CA's are not the weakest link, the browser security is and (2) they need to find their targets traffic streams before they can do the MITM attack, which would mean doing MITM on all SSL connections which would be detected almost immediately. A compromised CA would be useful only if they were unable to exploit the targets computer, and they needed to view SSLd traffic anyway, which does not appear to be a common situation for them circa 2013.
No. They can develop a system that involves every certificate produced by every CA being published in public audit logs, and then make Chrome verify that any given cert is in those public audit logs, thus allowing savvy site operators to find fake certs issued in their name (also useful for old fashioned phishing). And in fact that's exactly what they are doing.
Page speed is also a ranking factor. Do Google mean that you get an actual ranking *boost* from your current state or just that the small drop that you would get from having a slower website speeds from HTTPS will be ignored if it's using HTTPS? The latter would make more sense, since from a user's perspective, HTTP or HTTPS isn't relevant to the content they are looking for. It's still a good direction, but it isn't clear whether HTTPS will necessarily rank better than the same site over HTTP.
If it 's just an info site or something and you don't submit any confidential information, why do you need https? If I own a pizza shop, my website is all get requests, and I'm not worried about third parties seeing what's on my menu, why should I have to buy an SSL certificate? This seems like overkill to me.
Democracy Now! - your daily, uncensored, corporate-free
http://www.arthur-schiwon.de/w...
Google forces weakest shittiest broken RC4 crypto and calls it secure.
Who logs in to gdm? Not I, said the duck.
When I completed the survey, I was instructed to hotlink the image. My understanding of copyright and contract law is that permission to hotlink does not imply permission to rehost nor vice versa. And according to a page on the author's web site, there is no clear way to contact the author.
hear hear! Sure, encryption is great and has its uses... But also comes at the cost of processing, configuration, maintenance, and low cost 3rd party providers. GoDaddy is about a to get a shitload of extra customers. When the products in the market are comprable, the well known low cost one is frequently the winner. Thanks Google.
Too bad you don't know what the fuck you're talking about.
Yes, we really should rank pages using the "universal-relevance-attribute" on the root element...
Who says that page with more incoming links is relevant? It all depends on the context... People searching to buy should definitely only be guided to HTTPS protected site, right?
Fact is that HTTPS implies that the author is actively maintaining the site. With at least some effort.
Also odds are that a malicious site is more likely not to have SSL, it cost money per domain and the scam sites are usually deployed on many different domain names...
My site uses regular http for the "brochure" like main page and info pages (e.g. FAQs, how-tos), and uses https for the login pages and software-as-a-service web-app pages.
Is there something wrong, conceptually, with doing it that way?
Is that hybrid approach going to lower my ranking?
Not sure why one would go to https (and more intensive server-side processing) on the brochure and FAQ type pages.
Where are we going and why are we in a handbasket?
Yes. You didn't interpret the "my" as possessive did you? English is a very flexible language.
Internet Explorer didn't gain support for SNI until Windows Vista.
You are confusing with Windows XP with "IE on Windows XP". SNI works fine as long as you use other browser on Windows XP.
Other Trident-based browsers for Windows XP have the same problem as Internet Explorer for Windows XP, as does Safari for Windows XP. Besides, how are users of Internet Explorer, other Trident-based browsers, or Safari going to see the notice that viewing a site on Windows XP requires a Gecko- or Blink-based browser? All they'll get is a certificate error.
Seriously, who cares about ancient Android or Windows XP + IE?
People who don't want to have to spend time (which is money) handling support calls from users of "ancient Android or Windows XP + IE", or people who are trying to build a user base and who believe that certificate error messages delivered to the many remaining users of "ancient Android or Windows XP + IE" could ruin word of mouth. Now let me back up "many remaining users" with numbers: More than one out of five Android devices in operation as of January still ran Gingerbread because Google largely ignored phones during the Honeycomb era. And among the market as a whole, Net Applications.com shows more than one out of five running IE 8 or earlier. (I use IE 8 as a proxy for IE on XP because Windows Vista is eligible for upgrade to IE 9, and Windows 7 is eligible for upgrade to IE 11.)
Why not make a simple redirect to HTTP for those special cases
Because users will see a certificate error before they see the "simple redirect to HTTP".
Some web sites are strictly informational and gather no PII (personally identifiable information) or no information at all. There is no good reason for such a site to use HTTPS - there are no security issues associated with its use. Punishing the search rank of such a site for not using HTTPS is unfair.