4 ms·

"In 2014, we started encouraging other websites to use HTTPS by giving secure sites a ranking boost in Google Search." "We're working on those ....google.com i

"In 2014, we started encouraging other websites to use HTTPS by giving secure sites a ranking boost in Google Search." "We're working on those ....google.com is complicated" Having a top rank in Google results is a very serious business for a lot of companies. If this trend continues for HSTS i am a little worried. I do understand Google likes to encourage the rest of the world to have an as secure possible internet infrastructure, but i'm not so sure if those same companies would accept a lower Google ranking just because their IT department will tell them "It's complicated". It's not evil by far. But it's not really nice as well. By the way. Just checked https://hstspreload.org/?domain=blog.google https://hstspreload.org/?domain=blog.google. It says No HSTS header is present on the response.

CydeWeys 9y ago
We're working on standardizing HSTS carve-outs across browsers, which should help improve this process tremendously. The specific parts of google.com that are problematic are related to PKI infrastructure for Chrome (CRLs and such) that cannot be served encrypted. Most companies won't have these requirements, fortunately. And we do have many individual subdomains of google.com added to the list individually in lieu of carve-outs: https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json#258 https://chromium.googlesource.com/chromium/src/net/+/master/... As for blog.google, that's the beauty of TLD-wide HSTS. You don't need to do anything special on the individual websites, such as configuring headers, to get the benefit of HSTS. All you have to do is set up an SSL cert. The hstspreload.org site does not yet correctly display results for when a parent has HSTS enabled, but your browser itself does do the right thing. As for fixing what hstspreload.org displays, that's something I might take a crack at: https://github.com/chromium/hstspreload/issues/85 https://github.com/chromium/hstspreload/issues/85
- b3lvedere 9y ago
  Thanks for this awesome reply!
CydeWeys 9y ago
Oh, and another thing. I don't know if inclusion on the HSTS preload list will ever will be a website quality signal for Search, but it seems to me like full browser support for HSTS carve-outs would be a necessary prerequisite. We didn't start using HTTPS as a quality signal until well after all of our sites were encrypted, for example.
- b3lvedere 9y ago
  Thank you very much for your replies. I appreciate the time and effort you made.

CydeWeys 9y ago

We're working on standardizing HSTS carve-outs across browsers, which should help improve this process tremendously. The specific parts of google.com that are problematic are related to PKI infrastructure for Chrome (CRLs and such) that cannot be served encrypted. Most companies won't have these requirements, fortunately. And we do have many individual subdomains of google.com added to the list individually in lieu of carve-outs: https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json#258 https://chromium.googlesource.com/chromium/src/net/+/master/... As for blog.google, that's the beauty of TLD-wide HSTS. You don't need to do anything special on the individual websites, such as configuring headers, to get the benefit of HSTS. All you have to do is set up an SSL cert. The hstspreload.org site does not yet correctly display results for when a parent has HSTS enabled, but your browser itself does do the right thing. As for fixing what hstspreload.org displays, that's something I might take a crack at: https://github.com/chromium/hstspreload/issues/85 https://github.com/chromium/hstspreload/issues/85

b3lvedere 9y ago
Thanks for this awesome reply!

CydeWeys 9y ago

Oh, and another thing. I don't know if inclusion on the HSTS preload list will ever will be a website quality signal for Search, but it seems to me like full browser support for HSTS carve-outs would be a necessary prerequisite. We didn't start using HTTPS as a quality signal until well after all of our sites were encrypted, for example.

b3lvedere 9y ago
Thank you very much for your replies. I appreciate the time and effort you made.