11 ms·

Facebook Starts Switching All Users to HTTPS Connections

28 points by derpenxyne 14y ago

deleted 14y ago
[deleted]
acabal 14y ago
I was thinking about switching my sites to https-only also, because https-only is a good thing in general, but after doing some research it seems that it's unclear what will happen in terms of Google SEO. There's even a video on Youtube from Matt Cutts addressing that specific question from July or so, and his answer is basically something like, "I don't know for sure, but it I don't see why it would make a difference." What would be helpful is some sort Google-recognized meta tag that says, "this site is https only, please index it as such." 301 redirects might work in theory, but theory isn't good enough when your business relies on how it appears in Google's results. Even a temporary demotion could mean lots of money and confidence lost.
- deleted 14y ago
  [deleted]
  - EricBurnett 14y ago
    (Disclaimer: I work for Google, but not in websearch, and this is my personal opinion only) If this is a serious statement, then let me give you a serious answer: any minor increase in processing power won't inconvenience Google in the slightest. And even if it did, that still wouldn't matter. If it is good for web security and users - which I believe it is - then we're in favour of it. The consideration here is whether the algorithms are going to do the right thing, forwarding people, pagerank, referers, etc in the same way as before. That's not a question I can answer, but I'd go with whatever Matt Cutts has said.
- Matt_Cutts 14y ago
  I think you're referring to this video: http://www.youtube.com/watch?v=xeFo4ytOk8M http://www.youtube.com/watch?v=xeFo4ytOk8M At the time of that video, the indexing team was still working on one (very minor, corner case) type of issue, but I believe that was resolved. I'll double-check with the indexing team, but at this point I'd say feel free to go HTTPS. As always, I'd test it out first, ideally with a lower-traffic domain name. But if you like the results you get, you should be able to use our existing tools like 301s and rel=canonical to help Google discover that the site has gone HTTPS.
  - X-Istence 14y ago
    Does Google's bot do SNI?
- lucisferre 14y ago
  We use all https and there is no notable problems in indexing or SEO that I can see. We get indexed quickly and show up well I search results.
X-Istence 14y ago
The biggest problems I personally have with switching to HTTPS only for my sites: 1. I simply don't have enough IPv4 addresses to put each SSL site on its own IP address, IPv6, sure, bring it on ... but generally if someone has IPv6 connectivity, then they have SNI (see 3) 2. I don't have the money to get a certificate with X amount of domains on it 3. SNI is still not a good idea simply because there exist still a lot of Windows XP clients that are unable to use it. I am not too worried about the extra CPU cycles for the encryption decryption of connections... Currently on my sites I don't have any reason to use SSL, other than that I would like to protect certain resources such that my account username/password for my personal blog don't go across the ether in plain-text. For that I currently use self-signed SSL certs from a personal root that I can trust in the computers I want to trust them in.
- mfwoods 14y ago
  Single domain SSL certificates don't cost a lot of money or are even free[1] which are ideal for small/personal websites. Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. [1] StartSSL.com offers free 1 year single domain certificates.
  - jimktrains2 14y ago
    > Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. They why respond? You're missing the point about requiring an IPv4 addy for each cert. That's the big issue.
    - klapinat0r 14y ago
      > requiring an IPv4 addy for each cert Why not just offer HTTP and HTTPS on the same IP?
      - zaphoyd 14y ago
        HTTP and HTTPS are served on different ports so using a single IP for both typically isn't an issue. The issue here is that HTTP allows you to host multiple sites from one IP address, whereas HTTPS can only deliver a single certificate per IP address. This requires 1 IP per SSLed hostname. SNI lets you send multiple certificates on one IP, but client support isn't good enough yet. Multi-name certificates work better but can be more expensive.
dutchbrit 14y ago
This reminds me of when Iran blocked ssl connections, but I agree that security wise, they should of never been on http, but just https..
- riffic 14y ago
  should have
  - dutchbrit 14y ago
    Shouldn't have
newman314 14y ago
If you are considering going HTTPS only, please take the extra couple of minutes and make sure that your SSL setup is configured optimally. I often run into setups where someone has enabled SSL, gotten the cert installed and just left things at that with no further work done to configure versions/cipher preferences/http headers etc. SSL Labs Server Test is a good place to start: https://www.ssllabs.com/ssldb/ https://www.ssllabs.com/ssldb/
davis_m 14y ago
"People will be able to opt-out of HTTPS for maximum speed if that’s how they roll." Why is that even an option? This entire article is written in such a way that most users are going to assume that Facebook is going to start loading at a snails pace. Turning on SSL is technically slower, but it certainly is not going to be noticeable. Perhaps if all Facebook was serving was a couple of small text files, the overhead associated with SSL could be noticed, but with that isn't the case.

28 points by derpenxyne 14y ago

deleted 14y ago

[deleted]

I was thinking about switching my sites to https-only also, because https-only is a good thing in general, but after doing some research it seems that it's unclear what will happen in terms of Google SEO. There's even a video on Youtube from Matt Cutts addressing that specific question from July or so, and his answer is basically something like, "I don't know for sure, but it I don't see why it would make a difference." What would be helpful is some sort Google-recognized meta tag that says, "this site is https only, please index it as such." 301 redirects might work in theory, but theory isn't good enough when your business relies on how it appears in Google's results. Even a temporary demotion could mean lots of money and confidence lost.

deleted 14y ago
[deleted]
- EricBurnett 14y ago
  (Disclaimer: I work for Google, but not in websearch, and this is my personal opinion only) If this is a serious statement, then let me give you a serious answer: any minor increase in processing power won't inconvenience Google in the slightest. And even if it did, that still wouldn't matter. If it is good for web security and users - which I believe it is - then we're in favour of it. The consideration here is whether the algorithms are going to do the right thing, forwarding people, pagerank, referers, etc in the same way as before. That's not a question I can answer, but I'd go with whatever Matt Cutts has said.
Matt_Cutts 14y ago
I think you're referring to this video: http://www.youtube.com/watch?v=xeFo4ytOk8M http://www.youtube.com/watch?v=xeFo4ytOk8M At the time of that video, the indexing team was still working on one (very minor, corner case) type of issue, but I believe that was resolved. I'll double-check with the indexing team, but at this point I'd say feel free to go HTTPS. As always, I'd test it out first, ideally with a lower-traffic domain name. But if you like the results you get, you should be able to use our existing tools like 301s and rel=canonical to help Google discover that the site has gone HTTPS.
- X-Istence 14y ago
  Does Google's bot do SNI?
lucisferre 14y ago
We use all https and there is no notable problems in indexing or SEO that I can see. We get indexed quickly and show up well I search results.

X-Istence 14y ago

The biggest problems I personally have with switching to HTTPS only for my sites: 1. I simply don't have enough IPv4 addresses to put each SSL site on its own IP address, IPv6, sure, bring it on ... but generally if someone has IPv6 connectivity, then they have SNI (see 3) 2. I don't have the money to get a certificate with X amount of domains on it 3. SNI is still not a good idea simply because there exist still a lot of Windows XP clients that are unable to use it. I am not too worried about the extra CPU cycles for the encryption decryption of connections... Currently on my sites I don't have any reason to use SSL, other than that I would like to protect certain resources such that my account username/password for my personal blog don't go across the ether in plain-text. For that I currently use self-signed SSL certs from a personal root that I can trust in the computers I want to trust them in.

mfwoods 14y ago
Single domain SSL certificates don't cost a lot of money or are even free[1] which are ideal for small/personal websites. Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. [1] StartSSL.com offers free 1 year single domain certificates.
- jimktrains2 14y ago
  > Won't solve the three problems you listed, but saves you the trouble of installing your own personal root across your devices. They why respond? You're missing the point about requiring an IPv4 addy for each cert. That's the big issue.
  - klapinat0r 14y ago
    > requiring an IPv4 addy for each cert Why not just offer HTTP and HTTPS on the same IP?
    - zaphoyd 14y ago
      HTTP and HTTPS are served on different ports so using a single IP for both typically isn't an issue. The issue here is that HTTP allows you to host multiple sites from one IP address, whereas HTTPS can only deliver a single certificate per IP address. This requires 1 IP per SSLed hostname. SNI lets you send multiple certificates on one IP, but client support isn't good enough yet. Multi-name certificates work better but can be more expensive.

dutchbrit 14y ago

This reminds me of when Iran blocked ssl connections, but I agree that security wise, they should of never been on http, but just https..

riffic 14y ago
should have
- dutchbrit 14y ago
  Shouldn't have

newman314 14y ago

If you are considering going HTTPS only, please take the extra couple of minutes and make sure that your SSL setup is configured optimally. I often run into setups where someone has enabled SSL, gotten the cert installed and just left things at that with no further work done to configure versions/cipher preferences/http headers etc. SSL Labs Server Test is a good place to start: https://www.ssllabs.com/ssldb/ https://www.ssllabs.com/ssldb/

davis_m 14y ago

"People will be able to opt-out of HTTPS for maximum speed if that’s how they roll." Why is that even an option? This entire article is written in such a way that most users are going to assume that Facebook is going to start loading at a snails pace. Turning on SSL is technically slower, but it certainly is not going to be noticeable. Perhaps if all Facebook was serving was a couple of small text files, the overhead associated with SSL could be noticed, but with that isn't the case.