8 ms·
Google disables SSL search at BT’s request
- Mandatum 12y agoThis is set up at the carrier's level whereby they disable HTTP for Google search. To re-enable it, you can define your search to: https://encrypted.google.com/#q=search https://encrypted.google.com/#q=search
- fabulist 12y agoAre you saying adding "encrypted" to the URL fixes the problem? Because, the author does attempt to access google directly over HTTPS. And it is not set up at the carrier level; Google performed the redirection from HTTPS to HTTP.
- geocar 12y agoNo, it's set up at Google, whereby they disable the HTTP for Google search when asked to nicely (£££).
- chc 12y agoIt costs nothing to make your DNS server point users to nosslsearch.google.com. I think you are letting your feelings toward Google cloud your perception of reality.
- mindblast 12y agoWe are Google's product, not Google's customer. Keep this in mind, and use Google sparingly.
- fabulist 12y agoFor the privacy conscious, I don't really see a need to ever use Google (except perhaps for images). DuckDuckGo and Startpage are perfectly fine for your average search query; they aren't terrific for fresh news stories, in which case you can proceed directly to a news source or an aggregator. This is probably too much trouble for your average user, but for me it is worth it. Once you gain a knack for it, it really doesn't expend that much time, either.
- msandford 12y agoI just discovered that DuckDuckGo has some stuff in place to make it easy to add DuckDuckGo as your primary search engine in Chrome. Took me about three seconds. I am going to give it a try for a solid week at home and see if I can live with its results. I have no idea if they're as good, but I hope so.
- fabulist 12y agoDuckDuckGo's main problem is that they don't pick up new results as quickly as Google does. Otherwise, a query on DuckDuckGo looks very much like a query on Google (the top results are often identical.) If you can't find something on DuckDuckGo, try using Startpage. Startpage uses Google as a backend, so it often has fresher results than DuckDuckGo.
- higherpurpose 12y agoI think the problem is even worse on Startpage, which does use Google search, but Google is probably intentionally limiting the API to very old data.
- MichaelGG 12y agoDDG's main issue is that their results are just not good enough. I really, really wanted to like them and use them, but in all but the simplest queries, I ended up back at Google. I really want to ditch Google, but I don't see how. Except via Start Page.
- fabulist 12y agoThat was my experience with DDG several years ago, but not recently. Sometimes I check results in both search engines; they're always very similar.
- mey 12y agoA tip about migrating to duckduckgo, if you break down with the results and need to go back to google, just add !g to the query and it'll route you forward to google with a redirect. Just be aware, even if you are using DuckDuckGo via the Chrome Omni bar for searching, those results still end up in your Search History on Google (see https://history.google.com/history/ https://history.google.com/history/ ) As a result I'm on DDG + Firefox at this point
- icebraining 12y agoHow much do you pay for your search service?
- lmb 12y agoBT is the worst. Their Internet Hub or whatever they call their router does not allow changing DNS settings, because that would circumvent their crappy filtering. Would someone please stop thinking of the children!
- pbhjpbhj 12y agoIn the UK there are lots of other ISPs to choose from though. This probably cuts down on more users being told by fraudsters to change their DNS settings than it makes complaints from users wishing to change them?
- guard-of-terra 12y agoWhat Google seems to have done voluntarily will be forced on it tomorrow by repressive regimes all around the world. Google seems to have failed us once more.
- deciplex 12y agoRepressive regimes like the UK and the US, et cetera. I don't think it's fair to blame Google if they are complying with the law of the land and the wishes of society as expressed through the democratic process.
- guard-of-terra 12y agoI think this is as bad as trying to comply with backseat driver directions, verbatim. They are supposed to know how not to drive their product into the tree. Society doesn't. Their search is their product, and not "society's".
- deciplex 12y agoTheir product does belong to "society" to the extent that it is bound by the laws of that society. And if we pass laws that require them to spy on their users for the government, we can hardly complain when they follow the law.
- guard-of-terra 12y agoThey still have the choice of telling us "no". That's because our laws prohibit forced labor. They even said "no" before, in China, for example. But now it will be increasingly hard for them given what they sell for money.
- deciplex 12y agoI don't think that's reasonable to expect. You're asking an entire company of thousands of people - people who also participate in society and vote in elections - to teach society a lesson or something by refusing to do work you disagree with (and, for the record, I disagree with too). Probably a lot of people at Google are okay with spying - many of them helped elect Diane Feinstein, after all. I have a good idea where this is all headed, and probably within my lifetime people like you and me are going to be able to deal out some pretty damn bitter "I told you so's". In the meantime I will try to keep that from happening by trying to educate people, for as long as doing so doesn't get me killed. But expecting a group of people, many of whom don't agree with me anyway, to practice some mild civil disobedience on my behalf, would accomplish very little other than to drive me mad.
- alasdair_ 12y agoDear Google: remember that "don't be evil" thing? This is evil.
- JosephRedfern 12y agoThey've "outgrown" the "don't be evil" mantra now, apparently... http://www.theguardian.com/technology/2014/nov/03/larry-page-google-dont-be-evil-sergey-brin http://www.theguardian.com/technology/2014/nov/03/larry-page...
- icebraining 12y agoThat's not what the article says, it says they've outgrown their mission statement, which was to “organise the world’s information and make it universally accessible and useful”. Which makes sense, since they've expanded beyond information services.
- gohrt 12y agoBT blackmailed Google into doing this. The alternative is no Google on BT at all.
- IvyMike 12y agoI gotta be honest: I'd like to see what would happen if they tried this.
- estel 12y agoI assume you've got some evidence for your a claim that BT have broken the law like that? Especially when changing the CNAME record is something that absolutely any DNS provider could be doing anyway...
- andreasvc 12y agoCensoring wouldn't break the law, they're already doing that. And the blog post specifically mentions that it wasn't blocked using DNS but by a redirect from a Google server.
- truipe 12y agoThis might just be a use of the magic "nosslsearch" DNS record: https://productforums.google.com/forum/#!topic/websearch/1l2KMUfgyo4 https://productforums.google.com/forum/#!topic/websearch/1l2....
- fabulist 12y agoIt seems like that technique no longer works.
- truipe 12y agoThe end of the thread (from earlier this year) seems to indicate otherwise.
- fabulist 12y agoI tried it myself before making the comment and it did not work, but perhaps that was because of HTTPS Everywhere.
- truipe 12y agoA Google employee addresses this: https://productforums.google.com/d/msg/websearch/1l2KMUfgyo4/3TM7Z6F8DyIJ https://productforums.google.com/d/msg/websearch/1l2KMUfgyo4.... Apparently visiting `nosslsearch.google.com` directly does not have the intended effect, but setting up the CNAME record does.
- healsdata 12y agoThat page describes exactly what is happening: The network administrator can adjust the DNS configuration for www.google.com to point to our NoSSLSearch end point. For regular http traffic, the user will see no difference. We will not serve SSL search results for requests that we receive on this VIP. If we receive a search request over port 443, the certificate handshake will complete successfully, but we will then redirect the user to a non-SSL search experience. The first time a user is redirected, they will be shown a notice that SSL has been disabled by the network administrator. Google provides an option for network administrators to disable SSL searching on their own networks. It doesn't involve paying Google. You can see in this thread that filter manufacturers and their clients (schools, etc.) were the motivation for this feature and they'd simply block services that didn't allow filtering if the feature didn't exist.
- meigwilym 12y agoI'm a BT customer and I immediately checked this out. Using the latest Chrome/Firefox, searching for anything in the address bar is sent over https. Perhaps the author is being 'watched' as he is a surfing via BT's wifi pass?
- LeoPanthera 12y agoYes, this certainly only applies to BT public hotspots, not normal home internet.
- stuaxo 12y agoThink this will just be on BT Openworld, which they resell from anyones BT router.
- bithush 12y agoI hit this back in August when I moved and had to wait 2 weeks for my new line to be installed correctly[0]. I didn't care enough to find out why, I always use a VPN when using WiFi and to be fair to BT they recommend the use of a VPN when using the BT WiFi service. [0] It took BT 2 weeks to install the line correctly after cocking it up twice! Third times a charm. Great going BT! /s
- andreasvc 12y agoWhy did BT recommend using a VPN?
- LeoPanthera 12y agoThey would recommend it because public wifi is unencrypted and open to sniffing.
- mschuster91 12y agoEw. What happens if you use a normal https proxy server based e.g. in Germany?
- cbr 12y agoLooking at that transcript, the redirection from https://www.google.co.uk/.. https://www.google.co.uk/... to http://www.google.co.uk/.. http://www.google.co.uk/... does appear to be served by Google. It's over HTTPS so it's signed by a key only Google has.
- cortesoft 12y agoOr by a CA that is trusted by your browser....
- wcarss 12y agoFor anyone else wondering what the hell "BT" is, it's British Telecom, an ISP.
- blibble 12y agoit hasn't been British Telecom since 1991. these days they're into just about everything: landlines, tv, internet, mobiles, you name it. they tend to have a notorious reputation for providing a bad service, with their internet service being the prime example... god help you if something goes wrong with your phoneline.
- medecau 12y agoWould BT be the UK's version of Comcast?
- Aeoxic 12y agoMore or less, except Britain is currently experiencing the aftershock of David "Think of the Children" Cameron and his band of privacy-hating merrymen. While Verizon was caught out recently tracking users and Comcast maybe does the same, at least they don't forcibly restrict you from using HTTPS.
- kalleboo 12y agoI'd say a better analogy would be AT&T since it's the former monopoly
- corford 12y agoYes although our government has forced them to open up the last mile to competition. So unlike with Comcast/AT&T, at least here you can switch to a more palatable ISP fairly easily & quickly. You're still somewhat at the mercy of BT's engineers though if you have a fault on your line.
- andreasvc 12y agoAren't all of those about telecommunications? The name seems apt.
- cmsmith 12y agoNote: BT = British Telecom, a UK internet provider
- dubcanada 12y agoThat adds sooo much context that I was missing. I was like Bit torrent is asking Google to do what?
- mason55 12y agoI just noticed this for the first time in the AA lounge at Heathrow today. They use BT for their wifi and I got a notification that encrypted search had been disabled by my ISP. So it seems like it's all BT internet products that are doing it.
- tericho 12y agoI might get downvoted for this but I have two meta-questions: I assume BT is a European (or British) ISP? Is "seppuku" a common analogy people use? I just looked it up and was a bit surprised at the result.
- 0x0 12y agoI saw this behavior on a public wifi in london once. I think it also blocked "encrypted.google.com". Apparently google has an option for network administrators to force a redirect to "nosslsearch.google.com". Oddly enough, the "learn more" page has removed the reference to this domain, but it's in the wayback machine: http://web.archive.org/web/20140827203531/https://support.google.com/websearch/answer/186669?hl=en http://web.archive.org/web/20140827203531/https://support.go...
- pauldino 12y agoThe Wayback page doesn't reference "forcesafesearch.google.com" as the current one does, so perhaps "nosslsearch.google.com" is deprecated as a means of blocking adult content.
- corford 12y agoGrab a DO instance for $5/month, install openvpn on it, set it to serve over tcp & port 443 if you have to and then shove your DNS and everything else through that. Yes it's sad this is necessary but it's easy to do, costs virtually nothing and lets you sidestep most ISP filtering policies with the added bonus of protecting your traffic from whatever random wifi network you happen to be using to access the internet that day. If that's too much like hard work, there are also hundreds of 'VPN as a service' providers out there that will do it all for you for less than $7/month. Either way, it seems more and more quaint to me that anyone connecting via a mainstream ISP assumes they'll get an unadulterated feed to the internet. If you're an adult and want to decide for yourself how you'll use the internet, get a VPN in place and relegate your ISP to being a dumb bit pipe.
- frandroid 12y agoThe point is that Joe User won't be able, shouldn't have to do this.
- corford 12y agoDefinitely true neither they nor we should have to do it. Fortunately, there are still some good ISPs left in the UK. I'm with Andrews & Arnold and they're staunch supporters of an uncensored net (http://www.aa.net.uk/kb-broadband-realinternet.html http://www.aa.net.uk/kb-broadband-realinternet.html). They're also just generally awesome - dual homed static IPv4 and IPv6 addressing, a geek answers the phone if you ever have reason to call, you can choose your backhaul transit provider and lots of other nice things. You can even opt for billing that follows the lunar cycle :) Regardless of ISP though, I think even Joe User should figure out how to install & use a managed VPN service for when they're out and about using random wifi networks (e.g. from privateinternetaccess.com or similar). Of course, that assumes these VPN services are trustworthy which I'm sure a lot aren't...
- simi_ 12y agoThen automate it and charge $6 per month. :)
- agl 12y agoAt the moment, yes, no nosslsearch VIP will do this. However we're getting rid of it soon and replacing it with one that enables SafeSearch, but still over HTTPS: https://support.google.com/websearch/answer/186669?hl=en https://support.google.com/websearch/answer/186669?hl=en However, if you want an encrypted search option, https://encrypted.google.com/ https://encrypted.google.com/ is always encrypted and isn't affected by these methods.
- timothya 12y agoSome more information: http://googleonlinesecurity.blogspot.com/2014/10/an-update-to-safesearch-options-for.html http://googleonlinesecurity.blogspot.com/2014/10/an-update-t...
- simi_ 12y agoHa, you're the guy behind Pond (hi!). As a security researcher, how does it feel to work for a company that (reportedly) (pro)actively collaborates with the NSA? Are you ever worried that the company might not be as ethical as it seems to the average Googler? puts on tinfoil hat edit: Thank you for the downvote[s]! edit2: I just remembered a relevant example. Reading "How Google works", I clicked in many ways with their vision about smart creatives and how to run a company properly. However I then immediately realised that it's written by the same a-hole involved in the massive Google-Apple wage fixing scandal [0], and it made me question how much of what's in there is real. 0: http://www.cnet.com/news/judge-rejects-324-5m-wage-fixing-settlement-struck-by-apple-google-others/ http://www.cnet.com/news/judge-rejects-324-5m-wage-fixing-se...
- sarciszewski 12y agoYou're welcome for the upvote.
- deleted 12y ago[deleted]
- yuhong 12y agoI would not go that far, but it is funny how this was written after I suggested in HN comments that they do an apology letter to settle the scandal.
- atmosx 12y agoHm, reading the comments I get that it's always the same story: If you're not paying, you're the product. BT is trying to make some cash selling data to third parties. Since google allows to specific network blocks (defined probably by IP address) to use non-SSL connections, BT installed public WiFi to offer internet access and gather data which could be sold to advertisers. Is it really a goldmine? I'm not sure, with Google and Facebok gathering much more personal data than BT ever will, I'm not sure if it's a Goldmine, depends on the quantity and accuracy I guess...
- stuaxo 12y agoYou already have to pay BT to use these hotspots.
- superuser2 12y agoThis anti-feature is in place to support censorship by schools which wish to prevent students from Googling certain words. It's not surprising that it gets used for more nefarious things.
- jimeh 12y agoI was recently in the same situation as the author of this post. And as far as I can figure the reason HTTPS is disabled, is that the BT Wifi hotspots require you to login with username/password on a custom page before you can access the internet. Most people's default thing to do is google something, which then redirects them to the BT Wifi login page, but this only works if Google is being served up via HTTP, otherwise BT wouldn't be able to hijack the request and redirect you to the login page. Hence it's probably not got much to do with privacy, and more to do with usability. If +90% of users just got HTTPS/SSL security warnings from their browsers instead of a BT Wifi login page, they wouldn't be able to use BT Wifi unless they're of the minority who know and understand how HTTP/HTTPS connections work.
- ianlevesque 12y agoIt's worth noting however that both recent Windows and Mac OSes at least detect captive portals automatically and show the login page themselves, making elaborate and insecure hacks like that unnecessary.
- jimeh 12y agoThat is true, but everyone aren't running even recent-ish OSs. Also having relied on BT Wifi for about 2 weeks recently, I can definitely confirm that OSX's detection doesn't always work. About 80% of time, it's fine, the other 20% it's google for "asdf" and get redirected. Also, BT Wifi tends to log you out every 20 minutes to 6 hours seemingly by random, forcing you login with your credentials again, and this need to re-login is something that OSX never detected.
- andreasvc 12y agoIsn't that a security hazard? The mechanism of these captive portals is literally a MITM attack, and I don't see how to distinguish a benevolent from a malevolent use of it.
- justincormack 12y agoThere is an official http status code, but obviously no one uses it yet.
- danielweber 12y ago"this network has turned off SSL search" Honestly, I assumed this meant that Google wasn't allowed to do it. And since they couldn't secure you, they wouldn't give you your account.
- thrwwy63726272 12y agoYep my high school (in the US) has been doing this for years. They even blocked Duckduckgo this year. Google really needs to ditch this "feature". Edit: Just saw Agl's response, I'm glad Google is changing this.
- TazeTSchnitzel 12y agoMy school (when I still went to it) did this, presumably to allow filtering of search terms. It stopped you using Google over HTTPS to avoid filtering. The solution was simple: DuckDuckGo.
- deleted 12y ago[deleted]
- philip1209 12y agoSounds like you should run a VPN
- dang 12y agoWe changed the title because the original is baity. If anyone can suggest a better (i.e. more accurate and neutral) title, we'll change it again.
- doah78 12y agoI work for a school district in the US and we have to have a gateway content filter to prevent students from accessing inappropriate web sites. We use an iboss content filter which can decrypt ssl and rencrypt on the fly. It can also force google safe search and such. I suspect this company uses something similar. http://www.iboss.com/web_security_suite/wss_content_management.html http://www.iboss.com/web_security_suite/wss_content_manageme...
- depingus 12y ago>We use an iboss content filter which can decrypt ssl and rencrypt on the fly. Is it safe to assume this is some sort of trusted MITM proxy? I think this is really taking it too far. We use Lightspeed and they block SSL traffic during the handshake based on the domain its destined for. No need to decrypt anything.
- doah78 12y agoIt runs as a transparent proxy. We used to use Lightspeed but found it lacking in reporting. It can act as a MITM proxy if you turn the option on. We do however force safe search on search sites that the box works with.
- DoubleMalt 12y agoTHX for your efforts in bringing up the next generation of hackers and penetration testers!
- tripzilch 12y ago(Perhaps you were being sarcastic) but these kids most probably won't be able to access a great many of the informative and educational websites that allow them to research and learn about how to properly secure computers and their online experience. Because (I've seen this) they are most likely dumped under the category of "hacking websites" ... even perfectly benign network tools.
- deleted 12y ago