Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS as a ranking signal

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

21–30 of 212 posts

Re: HTTPS as a ranking signal

#21

Post by BorisMelnik »

AdamN wrote: post #12

I'm all about this but what about third party static sites like everything on Github Pages? We're using Github to host http://kili.io which has all of our marketing material but there's no way to upload a certificate there. I'd rather not move off of Github Pages for the main site because it's easy to just push changes, it's fast, it makes it easy to tie into the rest of our open code ( https://github.com/kili ), and…

Nice organization and cause, looks really interesting. Not being snarky at all but asking - you provide hosting but aren't able / won't host your marketing site on your own servers? Even if you don't have your own infrastructure, even grabbing a VPS from digital ocean or linode and throwing up a cert there could solve your problem.

Re: HTTPS as a ranking signal

#22

Post by BorisMelnik »

Don't have a ton of experience with SSL and only recently started messing with TLS on my Apache server but question: Google makes mention of a 2048 bit certificate but most of the certificates I see are 128/256. Is this number referring to something else other than the strength of the encryption?

Re: HTTPS as a ranking signal

#23

Post by sorbits »

Would be more awesome if they offered free certificates and an API to renew them.

Right now enabling https is not a one-time investment, since a new certificate has to be requested and installed each time the old one expires.

Computers are supposed to bring down cost and automate tedious tasks, for https the opposite is the case.

It’s worth mentioning that https://www.startssl.com/ does offer free certificates. But without a paid account they last only a year and cannot be issued to wildcard domains, so you quickly end up with a lot of certificates that has to be manually renewed each year.

Re: HTTPS as a ranking signal

#24

Post by dsl »

thejosh wrote: post #3

We recently changed our existing clients site to 100% SSL when we launched their new site. If only webmasters had an option to change http:// to https:// , the entire move would have been slightly easier as "fetch as googlebot" returns "redirect" since we direct http:// to https:// . Apart from that, we've had no ranking loss for their keywords.

Take a look at HSTS. It effectively tells clients to try HTTPS first when a user types in your domain.

http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Re: HTTPS as a ranking signal

#25

Post by joesavage »

etherealG wrote: post #20
Oculus wrote: post #13

I'm not sure I agree with this. I don't see a point in HTTPS for 100% static sites.

That 100% static site can be monitored. Which pages you visit on it and what that says about you. Privacy is always valuable.

I'm not sure about "always".

I run a site that provides counter information for League of Legends (http://www.championcounter.com/) and I doubt very much my users will benefit at all from me moving over to HTTPS.

Re: HTTPS as a ranking signal

#26

Post by hosay123 »

I'm sorry, but this simply isn't something a search engine should be dictating. Turning enabling SSL into some arms race that panics small businesses into buying millions of new, pointless certificates just isn't very fair.

This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works - and have provably done a horrible job of it in the past (websocket over SPDY, anyone? Yeah, I'm not even sure which version combination of SPDY and websocket I'm talking about either - pick one of the hundred)

There are strong arguments for not enabling privacy by default - not least since it prevents any kind of decentralization or caching of content. At a time when OpenSSL just suffered one of its worst bugs in history, forcing small sites to assume the risk of running code like this, which they inevitably will get wrong, materially worsens security for all, it doesn't improve it.

Re: HTTPS as a ranking signal

#29

Post by spacefight »

BorisMelnik wrote: post #22

Don't have a ton of experience with SSL and only recently started messing with TLS on my Apache server but question: Google makes mention of a 2048 bit certificate but most of the certificates I see are 128/256. Is this number referring to something else other than the strength of the encryption?

http://security.stackexchange.com/questions/19473/understand...

TL;DR: 2048bit is for the RSA keys, 128/256bit is the the key used in the SSL connection.

Re: HTTPS as a ranking signal

#30

Post by ckuehl »

BorisMelnik wrote: post #22

Don't have a ton of experience with SSL and only recently started messing with TLS on my Apache server but question: Google makes mention of a 2048 bit certificate but most of the certificates I see are 128/256. Is this number referring to something else other than the strength of the encryption?

Messages like "your connection is encrypted with 256-bit encryption" don't tell you anything about the size of the RSA keys in use.

During the TLS handshake, your browser and the server do public-key crypto to authenticate each other and share private information without a previously-known shared secret. Because public-key crypto is really, really slow, they then share a small secret (say, 128 or 256 bits), and use that secret as the key for a traditional symmetric encryption algorithm like AES. That's the number you're seeing.

Take a look at https://en.wikipedia.org/wiki/Transport_Layer_Security

Post reply on HN