26 ms·

HTTPS as a ranking signal

197 points by cleverjake 12y ago

ayrx 12y ago
Excellent move by Google that should push people to use HTTPS more. Hopefully this will take into account the supported TLS versions and ciphersuites as well. It's sad to see sites that only supports TLS 1.0 and prefers a CBC ciphersuite.
thejosh 12y ago
We recently changed our existing clients site to 100% SSL when we launched their new site. If only webmasters had an option to change http:// http:// to https:// https://, the entire move would have been slightly easier as "fetch as googlebot" returns "redirect" since we direct http:// http:// to https:// https://. Apart from that, we've had no ranking loss for their keywords.
- dsl 12y ago
  Take a look at HSTS. It effectively tells clients to try HTTPS first when a user types in your domain. http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
  - xyzzy123 12y ago
    ... after the first visit...
    - richbradshaw 12y ago
      Unless your site is on the HSTS list (https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr... for Chrome, Firefox use the same list by verifying by connecting via HTTPS and checking for a long HSTS time.)
      - xyzzy123 12y ago
        Right, unless your site is on the HSTS list AND all your users are using Chrome or firefox.... Which was basically my original point, which is that if you want your site to be generally accessible by just typing in the domain name, you still can't just turn off port 80... Which I guess is why google.com itself is still reachable on port 80.
maj0rhn 12y ago
I don't get it. I have a website that is purely content and available to everyone. It has no user accounts, no sign-ups, no nothing but static pages. Why should I use HTTPS for that? To prevent man-in-the-middle attacks?
- gnur 12y ago
  Not only attacks, but anyone on the same network on hops in between can see what sites and pages are being visited, the less data you leak, the less likely someone can build a case against you.
- nemesisj 12y ago
  Using HTTPS will let you know if the website you're visited is being messed with by a company, country, or regionally controlled firewall or content filter. If someone operating one of these filters took issue with your site, they could block certain content and users wouldn't necessarily know that it's happening.
- hueving 12y ago
  Is there a chance someone might modify the way your site appears for censorship or other gain?
viperchilldude 12y ago
The irony is that this will help Symantec, Comodo and Godaddy who are well known for stuffing their users sites with anchor-text (followed) links back to their own SSL pages.
hadoukenio 12y ago
A good move. Well done for pushing the world towards a safer internet. Quick question though. There was no mention of the type of certs used. Will plain certs be worth less than EV certs? Hopefully Matt or any other Google search representative here can comment.
- Nilzor 12y ago
  Newb question: Is plain cert locally generated certificates (free), while EV certs are those you pay for from a "trusted authority"?
  - tokenizerrr 12y ago
    No. A plain cert is one you normally buy, an EV cert stands for Extended Validation which only specific CAs can give out and there's extra guidelines for that, plus they're generally much more expensive. Browsers generally show the identity of the certificate in the URL bar when they are EV, which they otherwise do not.
  - ayrx 12y ago
    This link should explain the difference: http://security.stackexchange.com/q/15865/10211 http://security.stackexchange.com/q/15865/10211
jasonkester 12y ago
Makes sense. The reason seo spam is effective is because it's so cheap to get a new site (or ten thousand new sites) up and running. If you make that cost $50 per domain for the ssl cert, that will help ensure all those sites sift nicely down to the bottom of the rankings. Bonus points if they allow a single bad site to tarnish the reputation of all sites under a milti domain cert. We could have had this from the start if domain names weren't essentially free via domain tasting. But hey, better late than never.
- tristanperry 12y ago
  I do agree, however remember that you can get SSL certs from $9 (e.g. from NameCheap). You might be able to pay lower if you shop around too. Also even if it was used as a fairly strong ranking signal, if Google still approach their rankings like they do now, spammers might still have sufficient ranking 'weight' to overcome a lack of SSL certificate.
  - ldng 12y ago
    Don't forget you have to manage your certs. It's an extra burden. Let's say I am a freelancer, I make website for small restaurant. Until now I could make a website with frontpage, menu and gallery put it on a server and be done with it and collect a monthly fee. Now, you have to manage the cert, that is say every year re-issue a new cert and invalidate the old. It adds costs. Without much if any benefits for some class of websites.
    - cmg 12y ago
      I'm a freelance web developer for dozens of restaurants. They pay for the site, then a yearly hosting fee every year after launch. They get a basic CMS so they can update their hours/menus/etc. I host all their sites on a few VPS servers. Some of my contracts require support for IE 7 or IE 8 on Windows XP, and those browsers don't support SNI. So in addition to what you've mentioned - maintaining certificates and losing more of what little money I make on hosting (I basically charge a small % of the VPS cost plus a few hours' worth of work), I now will need to figure out another solution. It seems like a waste to spin up a new VPS for each site that requires XP support. Clients look at the <10% of visitors coming from Safari and IE7+8 on XP and say "those are potential customers." It's difficult to argue with that. For now though, I'm going to do nothing new. All indications are that HTTPS is going to be maybe 1% of the ranking, and I know my market well enough that the sites rank highly for local searches - which is the important part. They're responsive and they've all got social media presences, so until SSL is more important for PageRank, I'll wait it out.
AdamN 12y ago
I'm all about this but what about third party static sites like everything on Github Pages? We're using Github to host http://kili.io http://kili.io which has all of our marketing material but there's no way to upload a certificate there. I'd rather not move off of Github Pages for the main site because it's easy to just push changes, it's fast, it makes it easy to tie into the rest of our open code (https://github.com/kili https://github.com/kili), and it's free.
- BorisMelnik 12y ago
  Nice organization and cause, looks really interesting. Not being snarky at all but asking - you provide hosting but aren't able / won't host your marketing site on your own servers? Even if you don't have your own infrastructure, even grabbing a VPS from digital ocean or linode and throwing up a cert there could solve your problem.
- kalleboo 12y ago
  You could use a CDN like CloudFlare or CloudFront to proxy and add in SSL
Oculus 12y ago
I'm not sure I agree with this. I don't see a point in HTTPS for 100% static sites.
- ayrx 12y ago
  Static sites can have their content modified silently in a MITM attack as well.
- etherealG 12y ago
  That 100% static site can be monitored. Which pages you visit on it and what that says about you. Privacy is always valuable.
  - joesavage 12y ago
    I'm not sure about "always". I run a site that provides counter information for League of Legends (http://www.championcounter.com/ http://www.championcounter.com/) and I doubt very much my users will benefit at all from me moving over to HTTPS.
    - spacefight 12y ago
      Sure they would benefit. They could check whatever is on your site without anyone in between noticing (WLAN e.g. at starbucks, corporate LANs and the proxies used etc etc). There are companies out there, who buy surf-habits (read: browsing logs of URLs visited) and mine it for valuable data. Encrypt.
    - asperous 12y ago
      A lot of work routers might flag that site url as "GAMING" and with too much use could potentially contribute to someone losing their job. Also some isps have been caught injecting ads into plain text web sites [1]. Do you want more ads on your site that you didn't put there? [1] http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injection-cma.html http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injec...
      - 12y ago
ckuehl 12y ago
I'm interested in statistics (especially from websites with non-technical and international audiences) about what percent of visitors are using browsers/devices that don't support SNI. I don't know how representative this is, but it looks like StatCounter Global Stats [1] says that slightly over 10% of recorded visitors are still using Windows XP, and many of these users won't have SNI support. Small websites without strict security requirements often use shared hosting, where SNI is the only practical way to implement HTTPS. Alienating something like 10% of visitors with a security warning is probably not desirable. I imagine this could be a not insignificant roadblock to widespread SSL adoption on small websites, but would like to see more detailed stats. [1] http://gs.statcounter.com/#os-ww-monthly-201307-201407 http://gs.statcounter.com/#os-ww-monthly-201307-201407
- deleted 12y ago
  [deleted]
- eli 12y ago
  http://www.utilitydive.com/ http://www.utilitydive.com/ is a US-based news site for the electric utility industry. About 4.5% of visitors are on Win XP and most of those people are using XP. It's trending down pretty sharply; it was nearly twice that at the start of the year.
wtbob 12y ago
My issue with SSL everywhere is that I have to effectively buy my domain twice: once for the domain, and one again for the certificate. My registrar should give me a wildcard certificate good for the time I've paid for my domain.
- drdaeman 12y ago
  Maybe because there isn't much of demand for that, yet. Shall the transition come and we'd all perceive HTTPS as a default, it's very likely registrars would also offer certificate signing.
  - tootie 12y ago
    The price wars for domain registration pushed the cost way down over the past few years. Certs are starting to move in the same direction. As volume picks up, they can cut margins. And some guys will start to treat it as baseline feature and not a buy-up.
- prawn 12y ago
  This is my concern too. I manage 100+ clients registered and hosted in a variety of places (often because I'm inheriting their choice of host, registrar, etc). It's painful enough without adding SSL to the mix for even the littlest of sites.
BorisMelnik 12y ago
Don't have a ton of experience with SSL and only recently started messing with TLS on my Apache server but question: Google makes mention of a 2048 bit certificate but most of the certificates I see are 128/256. Is this number referring to something else other than the strength of the encryption?
- spacefight 12y ago
  http://security.stackexchange.com/questions/19473/understanding-2048-bit-ssl-and-256-bit-encryption http://security.stackexchange.com/questions/19473/understand... TL;DR: 2048bit is for the RSA keys, 128/256bit is the the key used in the SSL connection.
- ckuehl 12y ago
  Messages like "your connection is encrypted with 256-bit encryption" don't tell you anything about the size of the RSA keys in use. During the TLS handshake, your browser and the server do public-key crypto to authenticate each other and share private information without a previously-known shared secret. Because public-key crypto is really, really slow, they then share a small secret (say, 128 or 256 bits), and use that secret as the key for a traditional symmetric encryption algorithm like AES. That's the number you're seeing. Take a look at https://en.wikipedia.org/wiki/Transport_Layer_Security https://en.wikipedia.org/wiki/Transport_Layer_Security
  - BorisMelnik 12y ago
    thank you both, that really makes sense. I thought it was a little peculiar that Google decided to mention the whole 2048 bit thing, I couldn't have been the only one that was thrown off by that a bit.
- deleted 12y ago
  [deleted]
- hsivonen 12y ago
  2048 is the RSA key size. 128 or 256 is the AES key size (or more generally the key size for the symmetric cipher). Nowadays the latter doesn't depend on the cert, but in the 90s it artificially did thanks to U.S. export policy. CAs still advertise as if we were stuck in the 90s.
sorbits 12y ago
Would be more awesome if they offered free certificates and an API to renew them. Right now enabling https is not a one-time investment, since a new certificate has to be requested and installed each time the old one expires. Computers are supposed to bring down cost and automate tedious tasks, for https the opposite is the case. It’s worth mentioning that https://www.startssl.com/ https://www.startssl.com/ does offer free certificates. But without a paid account they last only a year and cannot be issued to wildcard domains, so you quickly end up with a lot of certificates that has to be manually renewed each year.
- bdamm 12y ago
  The SSL CA model is deeply flawed, so it bothers me that I have to pay into this broken cartel. An effective social network for website trust, combining cryptographic assurances with trust networks that already exist, is my dream. (Edit: Clarify that the SSL CA model is flawed for the Internet at large, but has many useful applications elsewhere.)
- kmfrk 12y ago
  Many "free" certificate services don't give reissued certificates for free, though, so if something like Heartbleed happens again, you might still pay a fee.
- ra 12y ago
  > Would be more awesome if they offered free certificates and an API to renew them. If someone were able to do this and pull the rug out from under the SSL cartel overnight, that would be awesome.
- diafygi 12y ago
  What about a kickstarter to subsidize SSL costs? Or how about one to buy a root CA and make it free?
  - icebraining 12y ago
    There is already a community-driven CA: http://www.cacert.org/ http://www.cacert.org/ The problem is that it's not only about money. You need to follow certain procedures or browsers and OSs won't include your root certificate.
hosay123 12y ago
I'm sorry, but this simply isn't something a search engine should be dictating. Turning enabling SSL into some arms race that panics small businesses into buying millions of new, pointless certificates just isn't very fair. This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works - and have provably done a horrible job of it in the past (websocket over SPDY, anyone? Yeah, I'm not even sure which version combination of SPDY and websocket I'm talking about either - pick one of the hundred) There are strong arguments for not enabling privacy by default - not least since it prevents any kind of decentralization or caching of content. At a time when OpenSSL just suffered one of its worst bugs in history, forcing small sites to assume the risk of running code like this, which they inevitably will get wrong, materially worsens security for all, it doesn't improve it.
- dalore 12y ago
  Google is free to use any metric to score their ranking. The difference is this one they are telling us about. HTTPS is also used to upgrade connections to stuff like HTTP2 and SPDY which give a substantial improvement to speed, which in turns improves satisfaction. So it makes sense to priotise https sites.
- deleted 12y ago
  [deleted]
  - wamatt 12y ago
    The OP was referring to the webmasters, not the search engine end users, as the ones being 'dictated'* to by Google. Unlike end users, webmasters themselves switching to Bing or DDG in their personal capacity would have little influence on their visitor's (end users) behavior. * 'firmly encouraged' is perhaps more appropriate ;)
- Strom 12y ago
  I think your description of the situation is rather overblown. Having HTTPS support will only get you a very minor boost in rankings. Additionally, discussing things in a forum usually doesn't get things moving. It's coming out with actual advancements like the original Chrome beta with V8 that drives innovation. I think that the solution to harmful dictatorship should be good alternatives, not more laws to shackle progress to humongous councils.
kmfrk 12y ago
This is great, but it should also be a reminder that SSL is currently not possible for custom domains hosted on GitHub: https://konklone.com/post/github-pages-now-supports-https-so-use-it#using-your-custom-domain https://konklone.com/post/github-pages-now-supports-https-so.... I hope a solution materializes eventually.
- mkal_tsr 12y ago
  Now you can contact Github with this announcement and voice your concerns. Now they have more incentive to change it (if people actively voice their issues to Github).
  - kmfrk 12y ago
    I don't have the best experience with submitting feedback to GitHub and getting good responses, so hopefully someone like @konklone can make that case to them - again.
- bobfunk 12y ago
  It's still expensive to offer SSL when you have a CDN in front unless you go with just SNI support (which could cost a significant portion of your visitors). We have CDN backed HTTPS for custom sites on BitBalloon (https://www.bitballoon.com https://www.bitballoon.com) if you're interested in a Github pages alternative that supports SSL.
  - bigiain 12y ago
    Yup - Akamai must be rubbing their hands in glee at this announcement. I've already started the conversations here about how much this is going to cost for big CDN hosted projects...
JensRantil 12y ago
Lol, they are not using HTTPS to serve that content. Look who's talking...
corford 12y ago
If this change is here to stay they should update their Adsense SSL advice... https://support.google.com/adsense/answer/10528?hl=en-GB https://support.google.com/adsense/answer/10528?hl=en-GB
- kmfrk 12y ago
  I do not envy the googlers who have to keep stuff like that up to date.
  - corford 12y ago
    I'm sure their salary more than makes up for it ;)
BorisMelnik 12y ago
Just doing a little more research. It appears as though many of these EV certs require you to verify your company information, domain registration, phone number and even address. With Google using however many hundred or thousand ranking signals, this makes sense. It is essentially another layer of trust and really great for UX as well. Online shoppers trust a site with the "green location bar" much more than ones without it, and I could definitely see how Google might reward this type of website.
cynusx 12y ago
This is great, it's just a fact that ssl will not have major adoption unless there's a clear UI or business reason for it. I hope google takes it one step further and updates chrome to show an insecure warning when it detects a password field on the page and it is sent plain over http.
Smerity 12y ago
Considering the importance of HTTPS to, in Google's words, "[making the] Internet safer more broadly", this seems like a good time to again suggest that Google enable HTTPS for Google Analytics by default[1]. Google Analytics is on 50.8% of the top million domains on the Internet, and on 26.96% of a randomly selected 48.5 million domains[1]. Of the 42 billion links analyzed in my research, over 48% of them had Google Analytics on either the start or the end. That's a lot of information leakage. Anyone who is eavesdropping on HTTP connections to the Google Analytics endpoints can observe a web user's traffic history trivially. This enables simple mass surveillance by specifically looking for these connections and recording them. HTTPS would prevent that. I should note, whilst there is an option to specifically force SSL in the new Google Analytics[2], it must be enabled by default in order to have a positive impact. We can't rely on the owners of millions of domains to upgrade to ensure an end user's privacy. [1]: http://smerity.com/articles/2013/google_analytics_and_nsa.html http://smerity.com/articles/2013/google_analytics_and_nsa.ht... [2]: https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#forceSSL https://developers.google.com/analytics/devguides/collection...
- RubyPinch 12y ago
  the default noted there seems fine? if HTTPS, then GA uses HTTPS, if HTTP, GA uses HTTP with firefox adding in mixed-content-complaining not too long ago [1], along with IE having it for a while, and apparantly chrome having it too, its best to match protocol to minimize issues for the user [1]: https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/ https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-bloc...
  - true_religion 12y ago
    It doesn't show up if you have an HTTPS script on an HTTP page.
  - Smerity 12y ago
    Browsers only complain if you go from HTTPS=>HTTP, not the other way around, so there is no mixed content warning. The article itself, hosted on Blogger, demonstrates this if you check the source code -- whilst the website is HTTP, it uses JS hosted on HTTPS, with no mixed content issue. To reiterate on the issue with HTTP default, the issue is that Google Analytics being HTTP on all HTTP sites results in a far easier man-in-the-middle target. An attacker only needs to eavesdrop on messages being sent to the Google Analytics endpoints, a far smaller and simpler task than observing and parsing all HTTP traffic. As such, a default of HTTP even if the website itself uses HTTP is something I'd term a major issue. An ISP or government agency could track the web traffic of an enormous number of users without having to perform any real processing of their own. Admittedly, they'd only see a subset of what Google sees, but that's still a lot.
drsintoma 12y ago
I'm surprised by the amount of negative comments. Independently of what do you think about HTTPS and CAs in general. Given there the alternative currently is plain text, I'm actually surprised that it wasn't a signal before.
- ldng 12y ago
  I see this has negative for several reasons : * Certificates are expensive (to buy _and_ to manage) * Crypto is hard and there will be a lot of screw up with inadequate certs in the wild for a long time. Just having a certificate does not mean much if it weak or broken. * Can't help the feeling it's an indirect push for cloud business hence possibly eating the margin of freelancers / ISV * Security Theatre : a lot of critical information for business still transit by email. Will Google force encrypted emails for the greater good ? I don't think so.
  - ldng 12y ago
    Some refuting instead of down voting ?
  - drsintoma 12y ago
    Google is not "enforcing" anything, people react like if you are not going to show up in the results at all, or Chrome won't work via HTTP. HTTPS is signal, just like having a link from a well ranked website like HN is a signal, and probably dozens other. The points you mention are in fact indicators that someone has put care and resources to make their site work more securely, which says a good thing about the site, which google rewards with some points in their algorithm. Makes perfect sense to me that this will somewhat improve the quality of their results. Would you also complain about google using fast response times as a signal because that "forces" people to pay for better servers? About your security point, google can not do that without loosing 50% of its customers, I really don't understand what that has to do with the rewarding HTTPS being good or bad. Looks like a red herring.
    - ldng 12y ago
      Right, you will not disappear from the results. The reaction (granted maybe overreaction) is about Google pushing HTTPS hard for security (which could be good but not automatically so) and not caring in areas where it is as important if not more. You are just proving my point. Google rewards the richest, those who have the resources as you say. As for care, I would be clad if people were not going to do it for the wrong incentives. Will Google just check if HTTPS is available and reward or will it also check for broken cipher and penalize ? I am not against HTTPS. Just saying that rewarding HTTPS is not enough. It's worst actually, some will set it up quickly and badly just for the extra ranking points and not the actual security it should be providing. To me the red herring here is pretending doing it for security. What is the point of HTTPS if I receive my password by mail ? To me email is more important to secure first. Google could perfectly incentive security practices in Gmail without loosing a single customer. I would even settle for just signing instead of encrypting mails. As for enforcing, HTTP2 (that is SPDY) IS enforcing HTTPS. IMO, Good HTTPS where it matters is more important then Crappy HTTPS everywhere just is ridiculous and could even be dangerous thanks to a false sense of security.
franze 12y ago
upside: security, further migration to HTTP/2 easier (when it's ready) downside: HTTPS negotiation time overhead (slower website) (as long as we use HTTP 1.1), costs (certificate, technical migration) all in all i think it's a great move by google, thx
- guruz 12y ago
  Only the first connection should be delayed a bit http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5...
deleted 12y ago
[deleted]
pierrefar 12y ago
I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere. Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner: 1. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How many times have you accessed a site on an open network or from a hotel and got unexpected ads? This is a very visible manifestation of the issue, but it can be much more subtle. 2. Authentication: How can users trust that the site is really the one it says it is? Imagine you're a content site that gives financial or medical advice. If I operated such a site, I'd really want to tell my readers that the advice they're reading is genuinely mine and not someone else pretending to be me. On top of these, your users get obvious (and not-so-obvious) benefits. Myself and fellow Googler and HNer Ilya Grigorik did a talk at Google I/O a few weeks ago that talks about these and a lot more in great detail: https://www.youtube.com/watch?v=cBhZ6S0PFCY https://www.youtube.com/watch?v=cBhZ6S0PFCY
- radmuzom 12y ago
  In my country, the cost of a SSL certificate is around 60% of my hosting costs, per year. I run a low-traffic blog with comments disabled, so users do not "interact" with the site in any way - except consume the content. I don't see any benefit from this.
  - grimmfang 12y ago
    I see the benefits but I have to agree. This is a very real barrier to entry, and not just financially. Making SSL a global standard is just one more thing new web developers have to appreciate.
  - lazylizard 12y ago
    https://www.startssl.com/?app=1 https://www.startssl.com/?app=1 and https://www.namecheap.com/campaigns/2014/reset-the-net.aspx https://www.namecheap.com/campaigns/2014/reset-the-net.aspx ???
    - 12y ago
Tomte 12y ago
It probably bugs me the way it does, because this "signal" has nothing to do with the contents or the usability of the web site (unlike speed, validity of HTML or, well, content itself), but is purely a "we just think you should do X" situation.
- not_kurt_godel 12y ago
  It has to do with preventing mass surveillance by default.
- cpeterso 12y ago
  HTTPS is relevant to the content because it will ensure that Google's search results direct users to the same content providers seen by Google's web crawlers.
- x1798DE 12y ago
  I would definitely prefer to use a site that supports HTTPS over HTTP. For personal safety reasons in addition to privacy and general welfare of the web. If you're searching for something and roughly the same content is available at safedomain.com vs. notoriouslysketchy.ru, I'd think you'd prefer to be shown the former above the latter. I don't see how this is much different.
mythz 12y ago
"Security is a top priority for Google. We invest a lot in making sure that our services use industry-leading security, like strong HTTPS encryption by default." -- Says Google site that forces HTTP.
- SquareWheel 12y ago
  People that write content for websites are not always the same people that build those websites. In this case, the search engine team is entirely separate from the Blogspot team.
  - mythz 12y ago
    > People that write content for websites are not always the same people that build those websites. Wow Seriously? You don't say. Seems the irony escaped you: announcement was made on a Google site that forces (i.e redirects from HTTPS) you to read it over HTTP. If you read closely enough it refers to all of Google, not just "the search engine team" or (Google - Blogspot).
    - rando289 12y ago
      Internet law: Your good post will be ruthlessly torn apart. Agreement is drivel. The best you can hope for is a slightly different point which happens to agree. Btw, I agree with you, and I think this phenomenon is dumb.
      - kevinmrose 12y ago
        Another internet law: Do as Google says, not as Google does.
    - SquareWheel 12y ago
      >Seems the irony escaped you Oh no, I commented on it directly. By the way I noticed you comment on Hacker News, you should probably stop using table-based layouts on your websites.
elsewhen 12y ago
there is something odd about this announcement. since it is no harder for a black hat publisher to switch to https than a white hat publisher, this signal will likely get noisy very quickly. i think google knows this, and its why they rarely specify ranking signals. so, then really, they are just using their dominance in search to effect change. now, you may agree with the change (they did something similar by announcing pageload time as a signal), but it makes me a little uneasy for google to leverage their dominance in this way even if i happen to agree with the goal.
riobard 12y ago
Here's the big differentiation that the now still beta and invite-only Google Domains could take on: assign free wildcard SSL certificate for every domain registered/transferred there.
CalRobert 12y ago
This wouldn't be so bad if there were more support for CAcert. It's great news for the commercial certificate authorities, though.
- Tomte 12y ago
  After some interaction (including assuring people), my impression of CAcert is much more negative than my impression with any of those big bad CAs everyone likes to complain about. They are so far off this side of "sane" it's really not funny.
  - CalRobert 12y ago
    Are you able to elaborate? If not that's fine, but I just don't think paying for a cert makes it somehow better, so I liked the idea of CAcert. If I should be concerned about using them to secure personal sites (in this sense really only used by myself and a few friends who have the CA root cert) I'd be interested in knowing.
EwanToo 12y ago
I've just signed up for a 5 year certificate using https://www.gogetssl.com/comodo-ssl-certificates/comodo-positive-ssl/ https://www.gogetssl.com/comodo-ssl-certificates/comodo-posi... for $18 - I know there's annual free ones, but at that price is it worth the hassle of renewing? Never used them before, but they're just a Comodo reseller, and they take Paypal, so there seemed little that could go wrong. Has so far gone smoothly, certificate installed, passes the SSL test google mention, https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ so it all seems good
netforay 12y ago
But this site is still on HTTP. When I tried HTTPS it redirected to HTTP. Even they are not ready it seems.
sireat 12y ago
So what reasonable options does a small to medium site operator now have to buy SSL certs? For example there is Comodo "FREE" certificate and the one that costs 64.95 Euros. What is the catch with the free one?
- tomjen3 12y ago
  Likely nothing relevant - you just can't revocate it, but it should still give you the speed boost.
ldng 12y ago
Let's kill small ISV and raise the bar of entrance to the internet. Oh certificate management is too complex and expensive for too little ROI ? Well see, here we have a nice "cheap to the eye" cloud solution just for you. Security isn't the priority here. Selling cloud is. Edit: IMHO, same goes for SPDY/HTTP2 by the way
scott_karana 12y ago
Wow. For those needing to support non-SNI browsers, this is going to become a real IPv4 address land-grab. IPv6 is disturbingly uncommon still...
- notatoad 12y ago
  supporting non-SNI browsers is less common. Over the last two years i've seen a huge drop off in ie8/XP traffic on my sites.
  - eli 12y ago
    But did it drop to zero? Are you willing to serve those people a big scary error message?
    - notatoad 12y ago
      it's definitely not zero. as for whether or not i'm willing to serve those people a big scary error message, i'm not sure yet. It's something we're actually going to have to come to a decision on in the next couple weeks though, this isn't a hypothetical for me. a lot of my traffic is repeat, so we'll probably do a good campaign to push users off IE8 this fall and officially declare it unsupported in Nov/Dec.
      - eli 12y ago
        Yeah, I didn't mean for that to come off as flip. We struggle with it too. Unfortunately we've still got 3 or 4 percent IE/XP on some sites, which feels like a lot to lose.
  - scott_karana 12y ago
    Android 2.x doesn't support SNI either, it's not just IE. (20% of Android users: https://developer.android.com/about/dashboards/index.html https://developer.android.com/about/dashboards/index.html) But I agree, it has dwindled rapidly. :-)
d0ugie 12y ago
Perhaps more people would be more inclined to get nudged by Google in this direction if Google got in the CA game and sold certificates themselves, 2048 bit, right on Google Play, Chrome Optimized certs, NFC and QR code-enabled. How about that?
afarrell 12y ago
I hope that at least one site runs without https so that when I am using airport/airline/FlyingJ/Starbucks/etc wifi, I can access it and be presented with the button I need to press to access the network. I currently use http://xkcd.com http://xkcd.com for this purpose.
- cbr 12y ago
  Funny; google.com works fine for me for this, even though it's definitely https.
hardmath123 12y ago
Usefulness of SSL aside, is anyone else terrified that Google can essentially dictate what it wants developers to do, with low search rankings as the penalty for not following them? In my opinion, this sets a scary precedent.
- jenscow 12y ago
  Yes. Fortunately, they're doing it in the name of improving the web. So far.
jon_wu 12y ago
Do you have to throw out all your social rankings? I've been wanting to switch to HTTPS but have been avoiding it due to significant accumulation of Facebook likes and some +1's. Last I checked, you had to do some big hacks to maintain your Facebook like count. Has anybody found a good way to handle this or do you just have to start over?
arikrak 12y ago
After you buy an SSL certificate, Heroku charges $20/month to use it. You can circumvent this with Cloudflare, but they also charge $20/month for SSL. Is there any easy way to use SSL on Heroku for $0-5 / month? (See http://www.quora.com/Is-there-any-way-to-use-HTTPS-on-Heroku-for-less-than-20-month/answer/Tim-Dierks http://www.quora.com/Is-there-any-way-to-use-HTTPS-on-Heroku... for one possibility.)
Scoundreller 12y ago
Google has a strong case to have HTTPS implemented: It prevents ISPs etc. from being able to profile your traffic, but not Google's, since you're probably visiting a site with Adsense or Analytics running on it anyway. Through HTTPS, Google is the only one with a profile of your traffic, and your ISP is no longer a competitor to them.
- lauradhamilton 12y ago
  Hm. I think this is the real answer.
sunnyujjawal 12y ago
It will kill small bloggers who are earning few $$ from website nothing have to do with payments or user interaction.
ksk 12y ago
I don't buy the 'this is for your own safety' nonsense. Having said that, when are Google going to improve their search algorithm? These days there are so many shitty content farm results that clog up the first page itself. How about improving that first? Unfortunately, Google is pretty much a monopoly when it comes to online advertising and search that few companies will have a choice in this matter. Google unilaterally forcing them to buy stuff doesn't sit well with me.
wildpeaks 12y ago
I guess this article from a month ago was right when they observed a boost of their ranking: https://blog.httpwatch.com/2014/07/07/google-has-given-https-a-huge-boost/ https://blog.httpwatch.com/2014/07/07/google-has-given-https...
arca_vorago 12y ago
I'm going to come out and say it. HTTPs is borked, in a functional way. On a social/technical level, it has become a false sense of security. The PRISM revelations let us know that the three letters and any corporate wannabe was doing MITM not just on http but on HTTPS whenever possible. I would say the ISP's and the CA's should all be considered compromised. We need something new and better, not to push HTTPs on everything as an imagined stop gap... That being said though, I do understand that if this was pushed to wider adoption, it would create a higher cost to perform such attacks, for ISP's and three letters?

197 points by cleverjake 12y ago

ayrx 12y ago

Excellent move by Google that should push people to use HTTPS more. Hopefully this will take into account the supported TLS versions and ciphersuites as well. It's sad to see sites that only supports TLS 1.0 and prefers a CBC ciphersuite.

thejosh 12y ago

We recently changed our existing clients site to 100% SSL when we launched their new site. If only webmasters had an option to change http:// http:// to https:// https://, the entire move would have been slightly easier as "fetch as googlebot" returns "redirect" since we direct http:// http:// to https:// https://. Apart from that, we've had no ranking loss for their keywords.

dsl 12y ago
Take a look at HSTS. It effectively tells clients to try HTTPS first when a user types in your domain. http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
- xyzzy123 12y ago
  ... after the first visit...
  - richbradshaw 12y ago
    Unless your site is on the HSTS list (https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr... for Chrome, Firefox use the same list by verifying by connecting via HTTPS and checking for a long HSTS time.)
    - xyzzy123 12y ago
      Right, unless your site is on the HSTS list AND all your users are using Chrome or firefox.... Which was basically my original point, which is that if you want your site to be generally accessible by just typing in the domain name, you still can't just turn off port 80... Which I guess is why google.com itself is still reachable on port 80.

maj0rhn 12y ago

I don't get it. I have a website that is purely content and available to everyone. It has no user accounts, no sign-ups, no nothing but static pages. Why should I use HTTPS for that? To prevent man-in-the-middle attacks?

gnur 12y ago
Not only attacks, but anyone on the same network on hops in between can see what sites and pages are being visited, the less data you leak, the less likely someone can build a case against you.
nemesisj 12y ago
Using HTTPS will let you know if the website you're visited is being messed with by a company, country, or regionally controlled firewall or content filter. If someone operating one of these filters took issue with your site, they could block certain content and users wouldn't necessarily know that it's happening.
hueving 12y ago
Is there a chance someone might modify the way your site appears for censorship or other gain?

viperchilldude 12y ago

The irony is that this will help Symantec, Comodo and Godaddy who are well known for stuffing their users sites with anchor-text (followed) links back to their own SSL pages.

hadoukenio 12y ago

A good move. Well done for pushing the world towards a safer internet. Quick question though. There was no mention of the type of certs used. Will plain certs be worth less than EV certs? Hopefully Matt or any other Google search representative here can comment.

Nilzor 12y ago
Newb question: Is plain cert locally generated certificates (free), while EV certs are those you pay for from a "trusted authority"?
- tokenizerrr 12y ago
  No. A plain cert is one you normally buy, an EV cert stands for Extended Validation which only specific CAs can give out and there's extra guidelines for that, plus they're generally much more expensive. Browsers generally show the identity of the certificate in the URL bar when they are EV, which they otherwise do not.
- ayrx 12y ago
  This link should explain the difference: http://security.stackexchange.com/q/15865/10211 http://security.stackexchange.com/q/15865/10211

jasonkester 12y ago

Makes sense. The reason seo spam is effective is because it's so cheap to get a new site (or ten thousand new sites) up and running. If you make that cost $50 per domain for the ssl cert, that will help ensure all those sites sift nicely down to the bottom of the rankings. Bonus points if they allow a single bad site to tarnish the reputation of all sites under a milti domain cert. We could have had this from the start if domain names weren't essentially free via domain tasting. But hey, better late than never.

tristanperry 12y ago
I do agree, however remember that you can get SSL certs from $9 (e.g. from NameCheap). You might be able to pay lower if you shop around too. Also even if it was used as a fairly strong ranking signal, if Google still approach their rankings like they do now, spammers might still have sufficient ranking 'weight' to overcome a lack of SSL certificate.
- ldng 12y ago
  Don't forget you have to manage your certs. It's an extra burden. Let's say I am a freelancer, I make website for small restaurant. Until now I could make a website with frontpage, menu and gallery put it on a server and be done with it and collect a monthly fee. Now, you have to manage the cert, that is say every year re-issue a new cert and invalidate the old. It adds costs. Without much if any benefits for some class of websites.
  - cmg 12y ago
    I'm a freelance web developer for dozens of restaurants. They pay for the site, then a yearly hosting fee every year after launch. They get a basic CMS so they can update their hours/menus/etc. I host all their sites on a few VPS servers. Some of my contracts require support for IE 7 or IE 8 on Windows XP, and those browsers don't support SNI. So in addition to what you've mentioned - maintaining certificates and losing more of what little money I make on hosting (I basically charge a small % of the VPS cost plus a few hours' worth of work), I now will need to figure out another solution. It seems like a waste to spin up a new VPS for each site that requires XP support. Clients look at the <10% of visitors coming from Safari and IE7+8 on XP and say "those are potential customers." It's difficult to argue with that. For now though, I'm going to do nothing new. All indications are that HTTPS is going to be maybe 1% of the ranking, and I know my market well enough that the sites rank highly for local searches - which is the important part. They're responsive and they've all got social media presences, so until SSL is more important for PageRank, I'll wait it out.

AdamN 12y ago

I'm all about this but what about third party static sites like everything on Github Pages? We're using Github to host http://kili.io http://kili.io which has all of our marketing material but there's no way to upload a certificate there. I'd rather not move off of Github Pages for the main site because it's easy to just push changes, it's fast, it makes it easy to tie into the rest of our open code (https://github.com/kili https://github.com/kili), and it's free.

BorisMelnik 12y ago
Nice organization and cause, looks really interesting. Not being snarky at all but asking - you provide hosting but aren't able / won't host your marketing site on your own servers? Even if you don't have your own infrastructure, even grabbing a VPS from digital ocean or linode and throwing up a cert there could solve your problem.
kalleboo 12y ago
You could use a CDN like CloudFlare or CloudFront to proxy and add in SSL

Oculus 12y ago

I'm not sure I agree with this. I don't see a point in HTTPS for 100% static sites.

ayrx 12y ago
Static sites can have their content modified silently in a MITM attack as well.
etherealG 12y ago
That 100% static site can be monitored. Which pages you visit on it and what that says about you. Privacy is always valuable.
- joesavage 12y ago
  I'm not sure about "always". I run a site that provides counter information for League of Legends (http://www.championcounter.com/ http://www.championcounter.com/) and I doubt very much my users will benefit at all from me moving over to HTTPS.
  - spacefight 12y ago
    Sure they would benefit. They could check whatever is on your site without anyone in between noticing (WLAN e.g. at starbucks, corporate LANs and the proxies used etc etc). There are companies out there, who buy surf-habits (read: browsing logs of URLs visited) and mine it for valuable data. Encrypt.
  - asperous 12y ago
    A lot of work routers might flag that site url as "GAMING" and with too much use could potentially contribute to someone losing their job. Also some isps have been caught injecting ads into plain text web sites [1]. Do you want more ads on your site that you didn't put there? [1] http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injection-cma.html http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injec...
    - 12y ago

ckuehl 12y ago

I'm interested in statistics (especially from websites with non-technical and international audiences) about what percent of visitors are using browsers/devices that don't support SNI. I don't know how representative this is, but it looks like StatCounter Global Stats [1] says that slightly over 10% of recorded visitors are still using Windows XP, and many of these users won't have SNI support. Small websites without strict security requirements often use shared hosting, where SNI is the only practical way to implement HTTPS. Alienating something like 10% of visitors with a security warning is probably not desirable. I imagine this could be a not insignificant roadblock to widespread SSL adoption on small websites, but would like to see more detailed stats. [1] http://gs.statcounter.com/#os-ww-monthly-201307-201407 http://gs.statcounter.com/#os-ww-monthly-201307-201407

deleted 12y ago
[deleted]
eli 12y ago
http://www.utilitydive.com/ http://www.utilitydive.com/ is a US-based news site for the electric utility industry. About 4.5% of visitors are on Win XP and most of those people are using XP. It's trending down pretty sharply; it was nearly twice that at the start of the year.

wtbob 12y ago

My issue with SSL everywhere is that I have to effectively buy my domain twice: once for the domain, and one again for the certificate. My registrar should give me a wildcard certificate good for the time I've paid for my domain.

drdaeman 12y ago
Maybe because there isn't much of demand for that, yet. Shall the transition come and we'd all perceive HTTPS as a default, it's very likely registrars would also offer certificate signing.
- tootie 12y ago
  The price wars for domain registration pushed the cost way down over the past few years. Certs are starting to move in the same direction. As volume picks up, they can cut margins. And some guys will start to treat it as baseline feature and not a buy-up.
prawn 12y ago
This is my concern too. I manage 100+ clients registered and hosted in a variety of places (often because I'm inheriting their choice of host, registrar, etc). It's painful enough without adding SSL to the mix for even the littlest of sites.

BorisMelnik 12y ago

Don't have a ton of experience with SSL and only recently started messing with TLS on my Apache server but question: Google makes mention of a 2048 bit certificate but most of the certificates I see are 128/256. Is this number referring to something else other than the strength of the encryption?

spacefight 12y ago
http://security.stackexchange.com/questions/19473/understanding-2048-bit-ssl-and-256-bit-encryption http://security.stackexchange.com/questions/19473/understand... TL;DR: 2048bit is for the RSA keys, 128/256bit is the the key used in the SSL connection.
ckuehl 12y ago
Messages like "your connection is encrypted with 256-bit encryption" don't tell you anything about the size of the RSA keys in use. During the TLS handshake, your browser and the server do public-key crypto to authenticate each other and share private information without a previously-known shared secret. Because public-key crypto is really, really slow, they then share a small secret (say, 128 or 256 bits), and use that secret as the key for a traditional symmetric encryption algorithm like AES. That's the number you're seeing. Take a look at https://en.wikipedia.org/wiki/Transport_Layer_Security https://en.wikipedia.org/wiki/Transport_Layer_Security
- BorisMelnik 12y ago
  thank you both, that really makes sense. I thought it was a little peculiar that Google decided to mention the whole 2048 bit thing, I couldn't have been the only one that was thrown off by that a bit.
deleted 12y ago
[deleted]
hsivonen 12y ago
2048 is the RSA key size. 128 or 256 is the AES key size (or more generally the key size for the symmetric cipher). Nowadays the latter doesn't depend on the cert, but in the 90s it artificially did thanks to U.S. export policy. CAs still advertise as if we were stuck in the 90s.

sorbits 12y ago

Would be more awesome if they offered free certificates and an API to renew them. Right now enabling https is not a one-time investment, since a new certificate has to be requested and installed each time the old one expires. Computers are supposed to bring down cost and automate tedious tasks, for https the opposite is the case. It’s worth mentioning that https://www.startssl.com/ https://www.startssl.com/ does offer free certificates. But without a paid account they last only a year and cannot be issued to wildcard domains, so you quickly end up with a lot of certificates that has to be manually renewed each year.

bdamm 12y ago
The SSL CA model is deeply flawed, so it bothers me that I have to pay into this broken cartel. An effective social network for website trust, combining cryptographic assurances with trust networks that already exist, is my dream. (Edit: Clarify that the SSL CA model is flawed for the Internet at large, but has many useful applications elsewhere.)
kmfrk 12y ago
Many "free" certificate services don't give reissued certificates for free, though, so if something like Heartbleed happens again, you might still pay a fee.
ra 12y ago
> Would be more awesome if they offered free certificates and an API to renew them. If someone were able to do this and pull the rug out from under the SSL cartel overnight, that would be awesome.
diafygi 12y ago
What about a kickstarter to subsidize SSL costs? Or how about one to buy a root CA and make it free?
- icebraining 12y ago
  There is already a community-driven CA: http://www.cacert.org/ http://www.cacert.org/ The problem is that it's not only about money. You need to follow certain procedures or browsers and OSs won't include your root certificate.

hosay123 12y ago

I'm sorry, but this simply isn't something a search engine should be dictating. Turning enabling SSL into some arms race that panics small businesses into buying millions of new, pointless certificates just isn't very fair. This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works - and have provably done a horrible job of it in the past (websocket over SPDY, anyone? Yeah, I'm not even sure which version combination of SPDY and websocket I'm talking about either - pick one of the hundred) There are strong arguments for not enabling privacy by default - not least since it prevents any kind of decentralization or caching of content. At a time when OpenSSL just suffered one of its worst bugs in history, forcing small sites to assume the risk of running code like this, which they inevitably will get wrong, materially worsens security for all, it doesn't improve it.

dalore 12y ago
Google is free to use any metric to score their ranking. The difference is this one they are telling us about. HTTPS is also used to upgrade connections to stuff like HTTP2 and SPDY which give a substantial improvement to speed, which in turns improves satisfaction. So it makes sense to priotise https sites.
deleted 12y ago
[deleted]
- wamatt 12y ago
  The OP was referring to the webmasters, not the search engine end users, as the ones being 'dictated'* to by Google. Unlike end users, webmasters themselves switching to Bing or DDG in their personal capacity would have little influence on their visitor's (end users) behavior. * 'firmly encouraged' is perhaps more appropriate ;)
Strom 12y ago
I think your description of the situation is rather overblown. Having HTTPS support will only get you a very minor boost in rankings. Additionally, discussing things in a forum usually doesn't get things moving. It's coming out with actual advancements like the original Chrome beta with V8 that drives innovation. I think that the solution to harmful dictatorship should be good alternatives, not more laws to shackle progress to humongous councils.

kmfrk 12y ago

This is great, but it should also be a reminder that SSL is currently not possible for custom domains hosted on GitHub: https://konklone.com/post/github-pages-now-supports-https-so-use-it#using-your-custom-domain https://konklone.com/post/github-pages-now-supports-https-so.... I hope a solution materializes eventually.

mkal_tsr 12y ago
Now you can contact Github with this announcement and voice your concerns. Now they have more incentive to change it (if people actively voice their issues to Github).
- kmfrk 12y ago
  I don't have the best experience with submitting feedback to GitHub and getting good responses, so hopefully someone like @konklone can make that case to them - again.
bobfunk 12y ago
It's still expensive to offer SSL when you have a CDN in front unless you go with just SNI support (which could cost a significant portion of your visitors). We have CDN backed HTTPS for custom sites on BitBalloon (https://www.bitballoon.com https://www.bitballoon.com) if you're interested in a Github pages alternative that supports SSL.
- bigiain 12y ago
  Yup - Akamai must be rubbing their hands in glee at this announcement. I've already started the conversations here about how much this is going to cost for big CDN hosted projects...

JensRantil 12y ago

Lol, they are not using HTTPS to serve that content. Look who's talking...

corford 12y ago

If this change is here to stay they should update their Adsense SSL advice... https://support.google.com/adsense/answer/10528?hl=en-GB https://support.google.com/adsense/answer/10528?hl=en-GB

kmfrk 12y ago
I do not envy the googlers who have to keep stuff like that up to date.
- corford 12y ago
  I'm sure their salary more than makes up for it ;)

BorisMelnik 12y ago

Just doing a little more research. It appears as though many of these EV certs require you to verify your company information, domain registration, phone number and even address. With Google using however many hundred or thousand ranking signals, this makes sense. It is essentially another layer of trust and really great for UX as well. Online shoppers trust a site with the "green location bar" much more than ones without it, and I could definitely see how Google might reward this type of website.

cynusx 12y ago

This is great, it's just a fact that ssl will not have major adoption unless there's a clear UI or business reason for it. I hope google takes it one step further and updates chrome to show an insecure warning when it detects a password field on the page and it is sent plain over http.

Smerity 12y ago

Considering the importance of HTTPS to, in Google's words, "[making the] Internet safer more broadly", this seems like a good time to again suggest that Google enable HTTPS for Google Analytics by default[1]. Google Analytics is on 50.8% of the top million domains on the Internet, and on 26.96% of a randomly selected 48.5 million domains[1]. Of the 42 billion links analyzed in my research, over 48% of them had Google Analytics on either the start or the end. That's a lot of information leakage. Anyone who is eavesdropping on HTTP connections to the Google Analytics endpoints can observe a web user's traffic history trivially. This enables simple mass surveillance by specifically looking for these connections and recording them. HTTPS would prevent that. I should note, whilst there is an option to specifically force SSL in the new Google Analytics[2], it must be enabled by default in order to have a positive impact. We can't rely on the owners of millions of domains to upgrade to ensure an end user's privacy. [1]: http://smerity.com/articles/2013/google_analytics_and_nsa.html http://smerity.com/articles/2013/google_analytics_and_nsa.ht... [2]: https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#forceSSL https://developers.google.com/analytics/devguides/collection...

RubyPinch 12y ago
the default noted there seems fine? if HTTPS, then GA uses HTTPS, if HTTP, GA uses HTTP with firefox adding in mixed-content-complaining not too long ago [1], along with IE having it for a while, and apparantly chrome having it too, its best to match protocol to minimize issues for the user [1]: https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/ https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-bloc...
- true_religion 12y ago
  It doesn't show up if you have an HTTPS script on an HTTP page.
- Smerity 12y ago
  Browsers only complain if you go from HTTPS=>HTTP, not the other way around, so there is no mixed content warning. The article itself, hosted on Blogger, demonstrates this if you check the source code -- whilst the website is HTTP, it uses JS hosted on HTTPS, with no mixed content issue. To reiterate on the issue with HTTP default, the issue is that Google Analytics being HTTP on all HTTP sites results in a far easier man-in-the-middle target. An attacker only needs to eavesdrop on messages being sent to the Google Analytics endpoints, a far smaller and simpler task than observing and parsing all HTTP traffic. As such, a default of HTTP even if the website itself uses HTTP is something I'd term a major issue. An ISP or government agency could track the web traffic of an enormous number of users without having to perform any real processing of their own. Admittedly, they'd only see a subset of what Google sees, but that's still a lot.

drsintoma 12y ago

I'm surprised by the amount of negative comments. Independently of what do you think about HTTPS and CAs in general. Given there the alternative currently is plain text, I'm actually surprised that it wasn't a signal before.

ldng 12y ago
I see this has negative for several reasons : * Certificates are expensive (to buy _and_ to manage) * Crypto is hard and there will be a lot of screw up with inadequate certs in the wild for a long time. Just having a certificate does not mean much if it weak or broken. * Can't help the feeling it's an indirect push for cloud business hence possibly eating the margin of freelancers / ISV * Security Theatre : a lot of critical information for business still transit by email. Will Google force encrypted emails for the greater good ? I don't think so.
- ldng 12y ago
  Some refuting instead of down voting ?
- drsintoma 12y ago
  Google is not "enforcing" anything, people react like if you are not going to show up in the results at all, or Chrome won't work via HTTP. HTTPS is signal, just like having a link from a well ranked website like HN is a signal, and probably dozens other. The points you mention are in fact indicators that someone has put care and resources to make their site work more securely, which says a good thing about the site, which google rewards with some points in their algorithm. Makes perfect sense to me that this will somewhat improve the quality of their results. Would you also complain about google using fast response times as a signal because that "forces" people to pay for better servers? About your security point, google can not do that without loosing 50% of its customers, I really don't understand what that has to do with the rewarding HTTPS being good or bad. Looks like a red herring.
  - ldng 12y ago
    Right, you will not disappear from the results. The reaction (granted maybe overreaction) is about Google pushing HTTPS hard for security (which could be good but not automatically so) and not caring in areas where it is as important if not more. You are just proving my point. Google rewards the richest, those who have the resources as you say. As for care, I would be clad if people were not going to do it for the wrong incentives. Will Google just check if HTTPS is available and reward or will it also check for broken cipher and penalize ? I am not against HTTPS. Just saying that rewarding HTTPS is not enough. It's worst actually, some will set it up quickly and badly just for the extra ranking points and not the actual security it should be providing. To me the red herring here is pretending doing it for security. What is the point of HTTPS if I receive my password by mail ? To me email is more important to secure first. Google could perfectly incentive security practices in Gmail without loosing a single customer. I would even settle for just signing instead of encrypting mails. As for enforcing, HTTP2 (that is SPDY) IS enforcing HTTPS. IMO, Good HTTPS where it matters is more important then Crappy HTTPS everywhere just is ridiculous and could even be dangerous thanks to a false sense of security.

franze 12y ago

upside: security, further migration to HTTP/2 easier (when it's ready) downside: HTTPS negotiation time overhead (slower website) (as long as we use HTTP 1.1), costs (certificate, technical migration) all in all i think it's a great move by google, thx

guruz 12y ago
Only the first connection should be delayed a bit http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5...

deleted 12y ago

[deleted]

pierrefar 12y ago

I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere. Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner: 1. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How many times have you accessed a site on an open network or from a hotel and got unexpected ads? This is a very visible manifestation of the issue, but it can be much more subtle. 2. Authentication: How can users trust that the site is really the one it says it is? Imagine you're a content site that gives financial or medical advice. If I operated such a site, I'd really want to tell my readers that the advice they're reading is genuinely mine and not someone else pretending to be me. On top of these, your users get obvious (and not-so-obvious) benefits. Myself and fellow Googler and HNer Ilya Grigorik did a talk at Google I/O a few weeks ago that talks about these and a lot more in great detail: https://www.youtube.com/watch?v=cBhZ6S0PFCY https://www.youtube.com/watch?v=cBhZ6S0PFCY

radmuzom 12y ago
In my country, the cost of a SSL certificate is around 60% of my hosting costs, per year. I run a low-traffic blog with comments disabled, so users do not "interact" with the site in any way - except consume the content. I don't see any benefit from this.
- grimmfang 12y ago
  I see the benefits but I have to agree. This is a very real barrier to entry, and not just financially. Making SSL a global standard is just one more thing new web developers have to appreciate.
- lazylizard 12y ago
  https://www.startssl.com/?app=1 https://www.startssl.com/?app=1 and https://www.namecheap.com/campaigns/2014/reset-the-net.aspx https://www.namecheap.com/campaigns/2014/reset-the-net.aspx ???
  - 12y ago

Tomte 12y ago

It probably bugs me the way it does, because this "signal" has nothing to do with the contents or the usability of the web site (unlike speed, validity of HTML or, well, content itself), but is purely a "we just think you should do X" situation.

not_kurt_godel 12y ago
It has to do with preventing mass surveillance by default.
cpeterso 12y ago
HTTPS is relevant to the content because it will ensure that Google's search results direct users to the same content providers seen by Google's web crawlers.
x1798DE 12y ago
I would definitely prefer to use a site that supports HTTPS over HTTP. For personal safety reasons in addition to privacy and general welfare of the web. If you're searching for something and roughly the same content is available at safedomain.com vs. notoriouslysketchy.ru, I'd think you'd prefer to be shown the former above the latter. I don't see how this is much different.

mythz 12y ago

"Security is a top priority for Google. We invest a lot in making sure that our services use industry-leading security, like strong HTTPS encryption by default." -- Says Google site that forces HTTP.

SquareWheel 12y ago
People that write content for websites are not always the same people that build those websites. In this case, the search engine team is entirely separate from the Blogspot team.
- mythz 12y ago
  > People that write content for websites are not always the same people that build those websites. Wow Seriously? You don't say. Seems the irony escaped you: announcement was made on a Google site that forces (i.e redirects from HTTPS) you to read it over HTTP. If you read closely enough it refers to all of Google, not just "the search engine team" or (Google - Blogspot).
  - rando289 12y ago
    Internet law: Your good post will be ruthlessly torn apart. Agreement is drivel. The best you can hope for is a slightly different point which happens to agree. Btw, I agree with you, and I think this phenomenon is dumb.
    - kevinmrose 12y ago
      Another internet law: Do as Google says, not as Google does.
  - SquareWheel 12y ago
    >Seems the irony escaped you Oh no, I commented on it directly. By the way I noticed you comment on Hacker News, you should probably stop using table-based layouts on your websites.

elsewhen 12y ago

there is something odd about this announcement. since it is no harder for a black hat publisher to switch to https than a white hat publisher, this signal will likely get noisy very quickly. i think google knows this, and its why they rarely specify ranking signals. so, then really, they are just using their dominance in search to effect change. now, you may agree with the change (they did something similar by announcing pageload time as a signal), but it makes me a little uneasy for google to leverage their dominance in this way even if i happen to agree with the goal.

riobard 12y ago

Here's the big differentiation that the now still beta and invite-only Google Domains could take on: assign free wildcard SSL certificate for every domain registered/transferred there.

CalRobert 12y ago

This wouldn't be so bad if there were more support for CAcert. It's great news for the commercial certificate authorities, though.

Tomte 12y ago
After some interaction (including assuring people), my impression of CAcert is much more negative than my impression with any of those big bad CAs everyone likes to complain about. They are so far off this side of "sane" it's really not funny.
- CalRobert 12y ago
  Are you able to elaborate? If not that's fine, but I just don't think paying for a cert makes it somehow better, so I liked the idea of CAcert. If I should be concerned about using them to secure personal sites (in this sense really only used by myself and a few friends who have the CA root cert) I'd be interested in knowing.

EwanToo 12y ago

I've just signed up for a 5 year certificate using https://www.gogetssl.com/comodo-ssl-certificates/comodo-positive-ssl/ https://www.gogetssl.com/comodo-ssl-certificates/comodo-posi... for $18 - I know there's annual free ones, but at that price is it worth the hassle of renewing? Never used them before, but they're just a Comodo reseller, and they take Paypal, so there seemed little that could go wrong. Has so far gone smoothly, certificate installed, passes the SSL test google mention, https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ so it all seems good

netforay 12y ago

But this site is still on HTTP. When I tried HTTPS it redirected to HTTP. Even they are not ready it seems.

sireat 12y ago

So what reasonable options does a small to medium site operator now have to buy SSL certs? For example there is Comodo "FREE" certificate and the one that costs 64.95 Euros. What is the catch with the free one?

tomjen3 12y ago
Likely nothing relevant - you just can't revocate it, but it should still give you the speed boost.

ldng 12y ago

Let's kill small ISV and raise the bar of entrance to the internet. Oh certificate management is too complex and expensive for too little ROI ? Well see, here we have a nice "cheap to the eye" cloud solution just for you. Security isn't the priority here. Selling cloud is. Edit: IMHO, same goes for SPDY/HTTP2 by the way

scott_karana 12y ago

Wow. For those needing to support non-SNI browsers, this is going to become a real IPv4 address land-grab. IPv6 is disturbingly uncommon still...

notatoad 12y ago
supporting non-SNI browsers is less common. Over the last two years i've seen a huge drop off in ie8/XP traffic on my sites.
- eli 12y ago
  But did it drop to zero? Are you willing to serve those people a big scary error message?
  - notatoad 12y ago
    it's definitely not zero. as for whether or not i'm willing to serve those people a big scary error message, i'm not sure yet. It's something we're actually going to have to come to a decision on in the next couple weeks though, this isn't a hypothetical for me. a lot of my traffic is repeat, so we'll probably do a good campaign to push users off IE8 this fall and officially declare it unsupported in Nov/Dec.
    - eli 12y ago
      Yeah, I didn't mean for that to come off as flip. We struggle with it too. Unfortunately we've still got 3 or 4 percent IE/XP on some sites, which feels like a lot to lose.
- scott_karana 12y ago
  Android 2.x doesn't support SNI either, it's not just IE. (20% of Android users: https://developer.android.com/about/dashboards/index.html https://developer.android.com/about/dashboards/index.html) But I agree, it has dwindled rapidly. :-)

d0ugie 12y ago

Perhaps more people would be more inclined to get nudged by Google in this direction if Google got in the CA game and sold certificates themselves, 2048 bit, right on Google Play, Chrome Optimized certs, NFC and QR code-enabled. How about that?

afarrell 12y ago

I hope that at least one site runs without https so that when I am using airport/airline/FlyingJ/Starbucks/etc wifi, I can access it and be presented with the button I need to press to access the network. I currently use http://xkcd.com http://xkcd.com for this purpose.

cbr 12y ago
Funny; google.com works fine for me for this, even though it's definitely https.

hardmath123 12y ago

Usefulness of SSL aside, is anyone else terrified that Google can essentially dictate what it wants developers to do, with low search rankings as the penalty for not following them? In my opinion, this sets a scary precedent.

jenscow 12y ago
Yes. Fortunately, they're doing it in the name of improving the web. So far.

jon_wu 12y ago

Do you have to throw out all your social rankings? I've been wanting to switch to HTTPS but have been avoiding it due to significant accumulation of Facebook likes and some +1's. Last I checked, you had to do some big hacks to maintain your Facebook like count. Has anybody found a good way to handle this or do you just have to start over?

arikrak 12y ago

After you buy an SSL certificate, Heroku charges $20/month to use it. You can circumvent this with Cloudflare, but they also charge $20/month for SSL. Is there any easy way to use SSL on Heroku for $0-5 / month? (See http://www.quora.com/Is-there-any-way-to-use-HTTPS-on-Heroku-for-less-than-20-month/answer/Tim-Dierks http://www.quora.com/Is-there-any-way-to-use-HTTPS-on-Heroku... for one possibility.)

Scoundreller 12y ago

Google has a strong case to have HTTPS implemented: It prevents ISPs etc. from being able to profile your traffic, but not Google's, since you're probably visiting a site with Adsense or Analytics running on it anyway. Through HTTPS, Google is the only one with a profile of your traffic, and your ISP is no longer a competitor to them.

lauradhamilton 12y ago
Hm. I think this is the real answer.

sunnyujjawal 12y ago

It will kill small bloggers who are earning few $$ from website nothing have to do with payments or user interaction.

ksk 12y ago

I don't buy the 'this is for your own safety' nonsense. Having said that, when are Google going to improve their search algorithm? These days there are so many shitty content farm results that clog up the first page itself. How about improving that first? Unfortunately, Google is pretty much a monopoly when it comes to online advertising and search that few companies will have a choice in this matter. Google unilaterally forcing them to buy stuff doesn't sit well with me.

wildpeaks 12y ago

I guess this article from a month ago was right when they observed a boost of their ranking: https://blog.httpwatch.com/2014/07/07/google-has-given-https-a-huge-boost/ https://blog.httpwatch.com/2014/07/07/google-has-given-https...

arca_vorago 12y ago

I'm going to come out and say it. HTTPs is borked, in a functional way. On a social/technical level, it has become a false sense of security. The PRISM revelations let us know that the three letters and any corporate wannabe was doing MITM not just on http but on HTTPS whenever possible. I would say the ISP's and the CA's should all be considered compromised. We need something new and better, not to push HTTPs on everything as an imagined stop gap... That being said though, I do understand that if this was pushed to wider adoption, it would create a higher cost to perform such attacks, for ISP's and three letters?