10 ms·

For Google, it’s not just about providing a secure environment and secure websites. In fact, Google actually has a monetary incentive to get as many websites to

For Google, it’s not just about providing a secure environment and secure websites. In fact, Google actually has a monetary incentive to get as many websites to move over to HTTPs as possible: convincing website owners to move to HTTPs will help get rid of competing ad networks.

aembleton 11y ago
How does it get rid of competing ad networks? Does Google have a monopoly on serving ads over HTTPS?
- callahad 11y ago
  It means your internet provider can't inject ads or profile you based on the content of the sites that you visit. Comcast, AT&T, and Verizon have all done similar: https://certsimple.com/blog/ssl-why-do-i-need-it#4-not-having-your-content-modified-by-carriers https://certsimple.com/blog/ssl-why-do-i-need-it#4-not-havin...
  - eyuelt 11y ago
    Sure they can. Your ISP can easily MitM you.
    - CydeWeys 11y ago
      Not without throwing cert errors on every site I visit. The only way they can MITM me is if they compromise my PC as well and install their root CA.
      - toyg 11y ago
        ... or rather get an intermediate certificate from one of the umpteen root CAs your operating system embeds by default. Is VeriSign going to refuse a certificate to AT&T?
        snowwrestler 11y ago
        Verisign will happily issue a certificate to AT&T for a domain that AT&T controls. Verisign will not issue a certificate to AT&T for google.com--no matter how nicely AT&T asks.
        geofft 11y ago
        Yes, and furthermore there's a very good reason to believe that this claim is true: as soon as they do, every copy of Chrome behind AT&T's network will go and snitch to Google, who will promptly investigate and get Verisign in deep trouble. Here's what happened when Symantec issued fake Google certificates last year: https://googleonlinesecurity.blogspot.com/2015/09/improved-digital-certificate-security.html https://googleonlinesecurity.blogspot.com/2015/09/improved-d... https://googleonlinesecurity.blogspot.com/2015/10/sustaining-digital-certificate-security.html https://googleonlinesecurity.blogspot.com/2015/10/sustaining... "Therefore we are firstly going to require that as of June 1st, 2016, all certificates issued by Symantec itself will be required to support Certificate Transparency. After this date, certificates newly issued by Symantec that do not conform to the Chromium Certificate Transparency policy may result in [annoying certificate warnings, just like self-signed certs]." And that was just the work of a couple of employees who were inappropriately testing their issuance system and weren't even intending to attack anything. They got fired, which I expect is also a big part of why Google's response was so light. http://www.symantec.com/connect/blogs/tough-day-leaders http://www.symantec.com/connect/blogs/tough-day-leaders
        notatoad 11y ago
        >Is VeriSign going to refuse a certificate to AT&T? I certainly hope so.
      - eyuelt 11y ago
        Ah. True, my mistake.
      - tomjen3 11y ago
        To connect to the internet you must install comcast internet-enhancing-certificate. It's the only way to make all websites secure by default™ No reason to compromise when you can force the user.
- joshstrange 11y ago
  For one IIRC it kills referer headers and so search engines/ad networks can't build out a graph of where a user was prior. Google OTOH sends the majority of the traffic and it's reach in ads allows it fill in the gaps better than any other network.
  - windsurfer 11y ago
    HTTPS does not kill referrer or referer headers. See https://referer.rustybrick.com/ https://referer.rustybrick.com/
    - bobby_9x 11y ago
      ..so why are all of the search terms suddenly gone from google searche referer headers? Which happened at the same time google defaulted to https?
      - kuschku 11y ago
        At that time they started using horribly annoying redirects.
      - dangrossman 11y ago
        They stopped linking search results directly to the webpages. You have no Google search referrer headers in your logs/analytics any more. When the SERP loads, all the results link to the real webpages, so that you see their address in the browser status bar when hovering over a link. Clicking any result link triggers a script that replaces the URL with https://google.com/url?url=the_real_webpage_url https://google.com/url?url=the_real_webpage_url. When you click through, you're clicking a link from google.com to another link on google.com, which redirects to the webpage you intended to visit. The referrer the webpage sees is the intermediate google.com/url page, instead of the search result page. This prevents websites from getting search term data from the SERP URL, if it was present, by removing that URL from referrer headers entirely.
      - windsurfer 11y ago
        Did you read the page I linked to? My referer was https://encrypted.google.com/search?hl=en&q=What%20Is%20My%20Secure%20Referrer https://encrypted.google.com/search?hl=en&q=What%20Is%20My%2...

aembleton 11y ago

How does it get rid of competing ad networks? Does Google have a monopoly on serving ads over HTTPS?

callahad 11y ago
It means your internet provider can't inject ads or profile you based on the content of the sites that you visit. Comcast, AT&T, and Verizon have all done similar: https://certsimple.com/blog/ssl-why-do-i-need-it#4-not-having-your-content-modified-by-carriers https://certsimple.com/blog/ssl-why-do-i-need-it#4-not-havin...
- eyuelt 11y ago
  Sure they can. Your ISP can easily MitM you.
  - CydeWeys 11y ago
    Not without throwing cert errors on every site I visit. The only way they can MITM me is if they compromise my PC as well and install their root CA.
    - toyg 11y ago
      ... or rather get an intermediate certificate from one of the umpteen root CAs your operating system embeds by default. Is VeriSign going to refuse a certificate to AT&T?
      - snowwrestler 11y ago
        Verisign will happily issue a certificate to AT&T for a domain that AT&T controls. Verisign will not issue a certificate to AT&T for google.com--no matter how nicely AT&T asks.
        geofft 11y ago
        Yes, and furthermore there's a very good reason to believe that this claim is true: as soon as they do, every copy of Chrome behind AT&T's network will go and snitch to Google, who will promptly investigate and get Verisign in deep trouble. Here's what happened when Symantec issued fake Google certificates last year: https://googleonlinesecurity.blogspot.com/2015/09/improved-digital-certificate-security.html https://googleonlinesecurity.blogspot.com/2015/09/improved-d... https://googleonlinesecurity.blogspot.com/2015/10/sustaining-digital-certificate-security.html https://googleonlinesecurity.blogspot.com/2015/10/sustaining... "Therefore we are firstly going to require that as of June 1st, 2016, all certificates issued by Symantec itself will be required to support Certificate Transparency. After this date, certificates newly issued by Symantec that do not conform to the Chromium Certificate Transparency policy may result in [annoying certificate warnings, just like self-signed certs]." And that was just the work of a couple of employees who were inappropriately testing their issuance system and weren't even intending to attack anything. They got fired, which I expect is also a big part of why Google's response was so light. http://www.symantec.com/connect/blogs/tough-day-leaders http://www.symantec.com/connect/blogs/tough-day-leaders
      - notatoad 11y ago
        >Is VeriSign going to refuse a certificate to AT&T? I certainly hope so.
    - eyuelt 11y ago
      Ah. True, my mistake.
    - tomjen3 11y ago
      To connect to the internet you must install comcast internet-enhancing-certificate. It's the only way to make all websites secure by default™ No reason to compromise when you can force the user.
joshstrange 11y ago
For one IIRC it kills referer headers and so search engines/ad networks can't build out a graph of where a user was prior. Google OTOH sends the majority of the traffic and it's reach in ads allows it fill in the gaps better than any other network.
- windsurfer 11y ago
  HTTPS does not kill referrer or referer headers. See https://referer.rustybrick.com/ https://referer.rustybrick.com/
  - bobby_9x 11y ago
    ..so why are all of the search terms suddenly gone from google searche referer headers? Which happened at the same time google defaulted to https?
    - kuschku 11y ago
      At that time they started using horribly annoying redirects.
    - dangrossman 11y ago
      They stopped linking search results directly to the webpages. You have no Google search referrer headers in your logs/analytics any more. When the SERP loads, all the results link to the real webpages, so that you see their address in the browser status bar when hovering over a link. Clicking any result link triggers a script that replaces the URL with https://google.com/url?url=the_real_webpage_url https://google.com/url?url=the_real_webpage_url. When you click through, you're clicking a link from google.com to another link on google.com, which redirects to the webpage you intended to visit. The referrer the webpage sees is the intermediate google.com/url page, instead of the search result page. This prevents websites from getting search term data from the SERP URL, if it was present, by removing that URL from referrer headers entirely.
    - windsurfer 11y ago
      Did you read the page I linked to? My referer was https://encrypted.google.com/search?hl=en&q=What%20Is%20My%20Secure%20Referrer https://encrypted.google.com/search?hl=en&q=What%20Is%20My%2...