HTTPS as a ranking signal • Hacker News Board

Re: HTTPS as a ranking signal

#51

Post by julioademar » Thu, Aug 07, 2014, 7:48 AM UTC

icebraining wrote: post #50

hosay123 wrote: post #26

I'm sorry, but this simply isn't something a search engine should be dictating. Turning enabling SSL into some arms race that panics small businesses into buying millions of new, pointless certificates just isn't very fair. This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works - and h…

This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works I don't see how is this any different from any other signal that Google uses to prioritize sites. Forcing small businesses to buy certificates doesn't seem any different than forcing them to have faster websites, for example. There…

> I don't see how is this any different from any other signal that Google uses to prioritize sites. «Oh, they're screwing up before, too? Then I guess it's alright»

> How does it prevent decentralization? Because only a handful of companies can issue certificates.

Re: HTTPS as a ranking signal

#52

Post by icebraining » Thu, Aug 07, 2014, 7:50 AM UTC

dsl wrote: post #27

Oculus wrote: post #13

I'm not sure I agree with this. I don't see a point in HTTPS for 100% static sites.

The NSA and other state actors can use non-secure pages to inject code to exploit the browser and compromise your visitors. http://en.wikipedia.org/wiki/FOXACID#QUANTUM_attacks

State actors are probably irrelevant in this discussion; few of them won't be able to get a certificate to any website they want, in my opinion.

Re: HTTPS as a ranking signal

#53

Post by pierrefar » Thu, Aug 07, 2014, 7:50 AM UTC

I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere.

Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner:

1. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How many times have you accessed a site on an open network or from a hotel and got unexpected ads? This is a very visible manifestation of the issue, but it can be much more subtle.

2. Authentication: How can users trust that the site is really the one it says it is? Imagine you're a content site that gives financial or medical advice. If I operated such a site, I'd really want to tell my readers that the advice they're reading is genuinely mine and not someone else pretending to be me.

On top of these, your users get obvious (and not-so-obvious) benefits. Myself and fellow Googler and HNer Ilya Grigorik did a talk at Google I/O a few weeks ago that talks about these and a lot more in great detail:

https://www.youtube.com/watch?v=cBhZ6S0PFCY

Re: HTTPS as a ranking signal

#54

Post by Tomte » Thu, Aug 07, 2014, 7:54 AM UTC

It probably bugs me the way it does, because this "signal" has nothing to do with the contents or the usability of the web site (unlike speed, validity of HTML or, well, content itself), but is purely a "we just think you should do X" situation.

Re: HTTPS as a ranking signal

#55

Post by mythz » Thu, Aug 07, 2014, 7:56 AM UTC

"Security is a top priority for Google. We invest a lot in making sure that our services use industry-leading security, like strong HTTPS encryption by default."

-- Says Google site that forces HTTP.

Re: HTTPS as a ranking signal

#56

Post by bobfunk » Thu, Aug 07, 2014, 7:58 AM UTC

kmfrk wrote: post #28

This is great, but it should also be a reminder that SSL is currently not possible for custom domains hosted on GitHub: https://konklone.com/post/github-pages-now-supports-https-so... . I hope a solution materializes eventually.

It's still expensive to offer SSL when you have a CDN in front unless you go with just SNI support (which could cost a significant portion of your visitors).

We have CDN backed HTTPS for custom sites on BitBalloon (https://www.bitballoon.com) if you're interested in a Github pages alternative that supports SSL.

Re: HTTPS as a ranking signal

#57

Post by icebraining » Thu, Aug 07, 2014, 7:58 AM UTC

julioademar wrote: post #51

icebraining wrote: post #50

Earlier quoted context omitted.

This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works I don't see how is this any different from any other signal that Google uses to prioritize sites. Forcing small businesses to buy certificates doesn't seem any different than forcing them to have faster websites, for example. There…

> I don't see how is this any different from any other signal that Google uses to prioritize sites. «Oh, they're screwing up before, too? Then I guess it's alright» > How does it prevent decentralization? Because only a handful of companies can issue certificates.

«Oh, they're screwing up before, too? Then I guess it's alright»

How is it screwing up? How are they supposed to run a search engine without prioritizing? "Here's 30000 results, we've randomly sorted them for you"?

Because only a handful of companies can issue certificates.

Fair enough.

Re: HTTPS as a ranking signal

#58

Post by elsewhen » Thu, Aug 07, 2014, 7:59 AM UTC

there is something odd about this announcement. since it is no harder for a black hat publisher to switch to https than a white hat publisher, this signal will likely get noisy very quickly. i think google knows this, and its why they rarely specify ranking signals.

so, then really, they are just using their dominance in search to effect change. now, you may agree with the change (they did something similar by announcing pageload time as a signal), but it makes me a little uneasy for google to leverage their dominance in this way even if i happen to agree with the goal.

Re: HTTPS as a ranking signal

#59

Post by kmfrk » Thu, Aug 07, 2014, 8:00 AM UTC

sorbits wrote: post #23

Would be more awesome if they offered free certificates and an API to renew them. Right now enabling https is not a one-time investment, since a new certificate has to be requested and installed each time the old one expires. Computers are supposed to bring down cost and automate tedious tasks, for https the opposite is the case. It’s worth mentioning that https://www.startssl.com/ does offer free certificates. But w…

Many "free" certificate services don't give reissued certificates for free, though, so if something like Heartbleed happens again, you might still pay a fee.

Re: HTTPS as a ranking signal

#60

Post by troels » Thu, Aug 07, 2014, 8:00 AM UTC

Strom wrote: post #47

hosay123 wrote: post #26

I'm sorry, but this simply isn't something a search engine should be dictating. Turning enabling SSL into some arms race that panics small businesses into buying millions of new, pointless certificates just isn't very fair. This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works - and h…

I think your description of the situation is rather overblown. Having HTTPS support will only get you a very minor boost in rankings. Additionally, discussing things in a forum usually doesn't get things moving. It's coming out with actual advancements like the original Chrome beta with V8 that drives innovation. I think that the solution to harmful dictatorship should be good alternatives, not more laws to shackle p…

"Having HTTPS support will only get you a very minor boost in rankings."

If your livelihood depends on getting traffic from Google - and a lot of sites do - then even a minor boost may equal a lot of money. Plus the fact that you can never know quite how much, so to be safe you must assume it's worthwhile.

The problem I have with this move is that to me it appears as Google are furthering their own political agenda. They want the web to be https, so they penalise sites that are not. It would be different if the argument was that sites on https tend to hold more quality content than non-https sites, but that doesn't seem to be the reasoning.