7 ms·

Bing Moving to Encrypt Search Traffic by Default

83 points by Errorcod3 11y ago

skrowl 11y ago
What's the point of encrypting the traffic in transit if you just PRISM (https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29 https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...) logs of it on the back end straight to the NSA? I guess this at least keeps random MITM attacks at bay?
- deleted 11y ago
  [deleted]
- j_s 11y ago
  It pressures destinations to move to HTTPS if they want referer info (although Google also shimmed in a redirect to protect privacy / analytics premium... I don't know if it's Bing or one of my add-ons that's leaving direct links.)
  - shostack 11y ago
    Do you have a source on GA Premium being a driver behind the secure search change? Everything I've seen says that is not available to GAP customers.
  - vgeek 11y ago
    Not exactly. HTTPS to HTTPS sessions should provide referrer information, but not with Google. See: https://yoast.com/web-https/ https://yoast.com/web-https/ Google SERP links are different in Chrome especially. Hover the link and you see one address, but copy the link URL and you'll see a number of parameters in addition to just the site URL. AFAIK, GA Premium is $150k/year and the sales rep I spoke with didn't allude to any solution to not provided. Don't get too comfortable if you're on the paid side, either. Adwords disabled exact match keywords a few months back. They now include 'similar' keywords, but that is just another black box similar to the QS system that they have always used to manipulate CPCs.
- scrollaway 11y ago
  The NSA is not every adversary.
  - stephengillie 11y ago
    No, but they're a funnel to many. Simply by them collecting or holding the data, it becomes available to numerous agencies from numerous governments, and also to hacking groups.
    - necrodawg 11y ago
      Also companies. The main idea with the NSA is corporate espionage.
- shostack 11y ago
  Outside of the privacy/security win for users and the PR win for Microsoft, it is likely to provide a business advantage depending on how they incorporate this data in Bing Ads. Right now, you can get Bing organic query data in Google Analytics and other web analytics tools. This is invaluable to marketers, and even more so now that Google's organic data only shows up as "not provided." If the Bing Ads team provides organic data within the Bing Ads platform like Google AdWords does, that is a reason to get people using their ad platform. Not sure offhand if that data will exist in some form via Bing Webmaster Tools as well, but right now in Google land, the only two places you can get organic query data are AdWords and Webmaster Tools.
- nivla 11y ago
  Isn't Google part of it too? If you scrape out Google and Bing, what other good alternatives are you left with that wouldn't comply if requested? Isn't it better to have some prevention against random MITM, especially on mobile devices where your choices are fixed? Like preventing tracking injections from your ISP (namely Verizon or Comcast)?
  - Cyph0n 11y ago
    DDG might not comply. Yandex most likely won't. DDG uses Yandex results if I'm not mistaken, so no big difference.
  - asuffield 11y ago
    (Tedious disclaimer: my opinion, not my employer's. Not representing anybody else. I work at Google.) We have made multiple extremely clear statements on this topic. I link a couple of them here: http://googleblog.blogspot.com/2013/06/what.html http://googleblog.blogspot.com/2013/06/what.html http://venturebeat.com/2013/06/19/google-issues-clearest-statement-yet-on-nsa-and-prism-no-server-access-no-back-door-no-drop-box-no-free-for-all/ http://venturebeat.com/2013/06/19/google-issues-clearest-sta...
    - toomuchtodo 11y ago
      My favorite Google response: https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k
    - obstinate 11y ago
      Also this: http://arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/ http://arstechnica.com/information-technology/2013/11/google...
- lern_too_spel 11y ago
  By encrypting traffic, Microsoft ensures your queries will only be collected by a third party if you're being investigated by the FBI or some other government with a court order. Without encryption, anybody between you and Bing can see your queries.
  - themeek 11y ago
    Well, that's generous. You don't have to be specifically investigated by the FBI (just 'related') and the court orders used to make requests can be quite large and in practice are primarily automated. If you look at the sort of processing the NSA is talking about they are discussing large scale sentiment and social media analysis (of the sort that non-related folks must be included). On this line we know that anyone 'three hops away' was considered legally relevant to an investigation. It was shown in the Snowden documents that NSA hacked into backend databases of US corporations to collect data - which gave data access with no warrant. Finally, companies are encouraged to give data to the government as a gift. This gifting of data is not compulsed legally and is outside the scope of (weak) legislation by FREEDOM providing some small limitations on bulk collection requests.
    - lern_too_spel 11y ago
      If you have an associate or an associate of an associate who is a known threat to national security, and the government submits a request for your data, you are specifically being investigated. From Google's transparency reports, we know that the number of foreigners being investigated is in the low tens of thousands, and the number of Americans being investigated is at most low single digit thousands. We know that all corporations that had their inter-datacenter networks compromised (there is no evidence their databases were accessed) have since encrypted traffic on those links, making that a non-issue. The last remaining place to collect data in bulk is between the user and the service, which is what this blog post addresses. The data-gifting is a figment of your imagination. Nobody will go out of their way to make their own data accessible to a third party for free, and these Internet companies in particular wouldn't share it with anybody.
      - 11y ago
- willscott 11y ago
  It would also be fascinating to know what sort of compromises if any are needed to allow this change to occur for operations in China.
  - pki 11y ago
    Some major chinese browser doesn't validate any cert at all, even self signed is perfectly OK (360 Browser, very large install base)/
- asanagi 11y ago
  Encryption doesn't just protect your message in transit. It also positively identifies you as a sender. This way, the feds not only get the contents of your searches, but they can positively prove that you are the one that initiated the search, so they can lock up "subversives" that much more easily.
finnn 11y ago
And yet on their blogpost announcing it, they use insecure resources and blogs.bing.com is only https if you manually specify the https, so it's basicaly not SSL'd.
taf2 11y ago
Amazing that so much attention is given to the NSA here... To me a more interesting question is how will this impact keyword data that's pasted through the referring URL? Will we be losing bing.com as a referrer on iOS similar to google.com?
- themeek 11y ago
  > Amazing that so much attention is given to the NSA here.. Well, the topic of default encryption is related to a mass global surveillance network supported by data collection capabilities built into the internet backbone - and HN is concerned about what these technical capabilities could mean for a runaway government or in the hands of adversarial entities/governments/groups. It's an incredibly important topic, so I'm glad there's some chat about it. > To me a more interesting question is how will this impact keyword data that's pasted through the referring URL? Doesn't Google have a redirect mechanism that allows referrer information to pass through when a 'blue link' is clicked?
  - zyx321 11y ago
    Last I checked, the only way to get the search keywords from those redirects was registering for Google webmaster tools.
- rand334 11y ago
  Microsoft is still a PRISM company, so I'm sure the NSA will still be able to access search data.
ausjke 11y ago
Does this simply mean you now do https://bing.com https://bing.com for searching? which google has been doing for a while?

83 points by Errorcod3 11y ago

What's the point of encrypting the traffic in transit if you just PRISM (https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29 https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...) logs of it on the back end straight to the NSA? I guess this at least keeps random MITM attacks at bay?

deleted 11y ago
[deleted]
j_s 11y ago
It pressures destinations to move to HTTPS if they want referer info (although Google also shimmed in a redirect to protect privacy / analytics premium... I don't know if it's Bing or one of my add-ons that's leaving direct links.)
- shostack 11y ago
  Do you have a source on GA Premium being a driver behind the secure search change? Everything I've seen says that is not available to GAP customers.
- vgeek 11y ago
  Not exactly. HTTPS to HTTPS sessions should provide referrer information, but not with Google. See: https://yoast.com/web-https/ https://yoast.com/web-https/ Google SERP links are different in Chrome especially. Hover the link and you see one address, but copy the link URL and you'll see a number of parameters in addition to just the site URL. AFAIK, GA Premium is $150k/year and the sales rep I spoke with didn't allude to any solution to not provided. Don't get too comfortable if you're on the paid side, either. Adwords disabled exact match keywords a few months back. They now include 'similar' keywords, but that is just another black box similar to the QS system that they have always used to manipulate CPCs.
scrollaway 11y ago
The NSA is not every adversary.
- stephengillie 11y ago
  No, but they're a funnel to many. Simply by them collecting or holding the data, it becomes available to numerous agencies from numerous governments, and also to hacking groups.
  - necrodawg 11y ago
    Also companies. The main idea with the NSA is corporate espionage.
shostack 11y ago
Outside of the privacy/security win for users and the PR win for Microsoft, it is likely to provide a business advantage depending on how they incorporate this data in Bing Ads. Right now, you can get Bing organic query data in Google Analytics and other web analytics tools. This is invaluable to marketers, and even more so now that Google's organic data only shows up as "not provided." If the Bing Ads team provides organic data within the Bing Ads platform like Google AdWords does, that is a reason to get people using their ad platform. Not sure offhand if that data will exist in some form via Bing Webmaster Tools as well, but right now in Google land, the only two places you can get organic query data are AdWords and Webmaster Tools.
nivla 11y ago
Isn't Google part of it too? If you scrape out Google and Bing, what other good alternatives are you left with that wouldn't comply if requested? Isn't it better to have some prevention against random MITM, especially on mobile devices where your choices are fixed? Like preventing tracking injections from your ISP (namely Verizon or Comcast)?
- Cyph0n 11y ago
  DDG might not comply. Yandex most likely won't. DDG uses Yandex results if I'm not mistaken, so no big difference.
- asuffield 11y ago
  (Tedious disclaimer: my opinion, not my employer's. Not representing anybody else. I work at Google.) We have made multiple extremely clear statements on this topic. I link a couple of them here: http://googleblog.blogspot.com/2013/06/what.html http://googleblog.blogspot.com/2013/06/what.html http://venturebeat.com/2013/06/19/google-issues-clearest-statement-yet-on-nsa-and-prism-no-server-access-no-back-door-no-drop-box-no-free-for-all/ http://venturebeat.com/2013/06/19/google-issues-clearest-sta...
  - toomuchtodo 11y ago
    My favorite Google response: https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k
  - obstinate 11y ago
    Also this: http://arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/ http://arstechnica.com/information-technology/2013/11/google...
lern_too_spel 11y ago
By encrypting traffic, Microsoft ensures your queries will only be collected by a third party if you're being investigated by the FBI or some other government with a court order. Without encryption, anybody between you and Bing can see your queries.
- themeek 11y ago
  Well, that's generous. You don't have to be specifically investigated by the FBI (just 'related') and the court orders used to make requests can be quite large and in practice are primarily automated. If you look at the sort of processing the NSA is talking about they are discussing large scale sentiment and social media analysis (of the sort that non-related folks must be included). On this line we know that anyone 'three hops away' was considered legally relevant to an investigation. It was shown in the Snowden documents that NSA hacked into backend databases of US corporations to collect data - which gave data access with no warrant. Finally, companies are encouraged to give data to the government as a gift. This gifting of data is not compulsed legally and is outside the scope of (weak) legislation by FREEDOM providing some small limitations on bulk collection requests.
  - lern_too_spel 11y ago
    If you have an associate or an associate of an associate who is a known threat to national security, and the government submits a request for your data, you are specifically being investigated. From Google's transparency reports, we know that the number of foreigners being investigated is in the low tens of thousands, and the number of Americans being investigated is at most low single digit thousands. We know that all corporations that had their inter-datacenter networks compromised (there is no evidence their databases were accessed) have since encrypted traffic on those links, making that a non-issue. The last remaining place to collect data in bulk is between the user and the service, which is what this blog post addresses. The data-gifting is a figment of your imagination. Nobody will go out of their way to make their own data accessible to a third party for free, and these Internet companies in particular wouldn't share it with anybody.
    - 11y ago
willscott 11y ago
It would also be fascinating to know what sort of compromises if any are needed to allow this change to occur for operations in China.
- pki 11y ago
  Some major chinese browser doesn't validate any cert at all, even self signed is perfectly OK (360 Browser, very large install base)/
asanagi 11y ago
Encryption doesn't just protect your message in transit. It also positively identifies you as a sender. This way, the feds not only get the contents of your searches, but they can positively prove that you are the one that initiated the search, so they can lock up "subversives" that much more easily.

finnn 11y ago

And yet on their blogpost announcing it, they use insecure resources and blogs.bing.com is only https if you manually specify the https, so it's basicaly not SSL'd.

taf2 11y ago

Amazing that so much attention is given to the NSA here... To me a more interesting question is how will this impact keyword data that's pasted through the referring URL? Will we be losing bing.com as a referrer on iOS similar to google.com?

themeek 11y ago
> Amazing that so much attention is given to the NSA here.. Well, the topic of default encryption is related to a mass global surveillance network supported by data collection capabilities built into the internet backbone - and HN is concerned about what these technical capabilities could mean for a runaway government or in the hands of adversarial entities/governments/groups. It's an incredibly important topic, so I'm glad there's some chat about it. > To me a more interesting question is how will this impact keyword data that's pasted through the referring URL? Doesn't Google have a redirect mechanism that allows referrer information to pass through when a 'blue link' is clicked?
- zyx321 11y ago
  Last I checked, the only way to get the search keywords from those redirects was registering for Google webmaster tools.
rand334 11y ago
Microsoft is still a PRISM company, so I'm sure the NSA will still be able to access search data.

ausjke 11y ago

Does this simply mean you now do https://bing.com https://bing.com for searching? which google has been doing for a while?