Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS as a ranking signal

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

71–80 of 212 posts

Re: HTTPS as a ranking signal

#71

Post by mkal_tsr »

pierrefar wrote: post #53

I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere. Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner: 1. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How man…

I mean, I understand their argument against it, but I think this is one of those cases where the pros definitely out-weigh the cons, this is great.

Re: HTTPS as a ranking signal

#72

Post by chmars »

pierrefar wrote: post #53

I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere. Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner: 1. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How man…

Another advantage to we masters with money … why?

SSL does not come cheap. Certificates have become cheap but you need your own IP, i.e., shared hosting is a problem and hosting becomes more expensive. Certificate sellers, hosters etc. on the other hand are certainly happy about these new business opportunities – although we all know that SSL is inherently broken.

OK, probably still better than nothing! :)

Re: HTTPS as a ranking signal

#73

Post by bigiain »

bobfunk wrote: post #56
kmfrk wrote: post #28

This is great, but it should also be a reminder that SSL is currently not possible for custom domains hosted on GitHub: https://konklone.com/post/github-pages-now-supports-https-so... . I hope a solution materializes eventually.

It's still expensive to offer SSL when you have a CDN in front unless you go with just SNI support (which could cost a significant portion of your visitors). We have CDN backed HTTPS for custom sites on BitBalloon ( https://www.bitballoon.com ) if you're interested in a Github pages alternative that supports SSL.

Yup - Akamai must be rubbing their hands in glee at this announcement. I've already started the conversations here about how much this is going to cost for big CDN hosted projects...

Re: HTTPS as a ranking signal

#74

Post by lazylizard »

radmuzom wrote: post #61
pierrefar wrote: post #53

I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere. Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner: 1. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How man…

In my country, the cost of a SSL certificate is around 60% of my hosting costs, per year. I run a low-traffic blog with comments disabled, so users do not "interact" with the site in any way - except consume the content. I don't see any benefit from this.

https://www.startssl.com/?app=1 and https://www.namecheap.com/campaigns/2014/reset-the-net.aspx ???

Re: HTTPS as a ranking signal

#75

Post by ra »

sorbits wrote: post #23

Would be more awesome if they offered free certificates and an API to renew them. Right now enabling https is not a one-time investment, since a new certificate has to be requested and installed each time the old one expires. Computers are supposed to bring down cost and automate tedious tasks, for https the opposite is the case. It’s worth mentioning that https://www.startssl.com/ does offer free certificates. But w…

> Would be more awesome if they offered free certificates and an API to renew them.

If someone were able to do this and pull the rug out from under the SSL cartel overnight, that would be awesome.

Re: HTTPS as a ranking signal

#76

Post by icebraining »

hnha wrote: post #70
icebraining wrote: post #50

Earlier quoted context omitted.

This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works I don't see how is this any different from any other signal that Google uses to prioritize sites. Forcing small businesses to buy certificates doesn't seem any different than forcing them to have faster websites, for example. There…

heartbleed was much much worse than unencrypted logins.

I agree that the worst case scenario is much worse; I don't see how it was much worse for the average website of a small business.

Re: HTTPS as a ranking signal

#77

Post by mseebach »

hosay123 wrote: post #26

I'm sorry, but this simply isn't something a search engine should be dictating. Turning enabling SSL into some arms race that panics small businesses into buying millions of new, pointless certificates just isn't very fair. This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works - and h…

> I'm sorry, but this simply isn't something a search engine should be dictating.

Damned if you do, damned if you don't. If the announcement from Google had been that they wouldn't want to use their considerable clout to promote SSL, they'd been criticized for putting their profits over improving the general long term health of the internet.

> have provably done a horrible job of it in the past

That's a single example of a new technology that didn't work out well. How about pioneering certificate pinning for a counter example? Nobody's perfect, if you never break anything it means you never try anything new. Also, websockets and SPDY isn't even close to "dictating" anything, it's a new technology that you can use or not use as you want to.

Re: HTTPS as a ranking signal

#78

Post by mike-cardwell »

radmuzom wrote: post #61
pierrefar wrote: post #53

I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere. Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner: 1. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How man…

In my country, the cost of a SSL certificate is around 60% of my hosting costs, per year. I run a low-traffic blog with comments disabled, so users do not "interact" with the site in any way - except consume the content. I don't see any benefit from this.

Get a free cert instead?

Re: HTTPS as a ranking signal

#79

Post by rimantas »

troels wrote: post #60
Strom wrote: post #47

Earlier quoted context omitted.

I think your description of the situation is rather overblown. Having HTTPS support will only get you a very minor boost in rankings. Additionally, discussing things in a forum usually doesn't get things moving. It's coming out with actual advancements like the original Chrome beta with V8 that drives innovation. I think that the solution to harmful dictatorship should be good alternatives, not more laws to shackle p…

"Having HTTPS support will only get you a very minor boost in rankings." If your livelihood depends on getting traffic from Google - and a lot of sites do - then even a minor boost may equal a lot of money. Plus the fact that you can never know quite how much, so to be safe you must assume it's worthwhile. The problem I have with this move is that to me it appears as Google are furthering their own political agenda.…

Well, if your livelihood depend on Google you do what they say, what's the problem? They did not force you to depend on them, did they?

Re: HTTPS as a ranking signal

#80

Post by kalleboo »

AdamN wrote: post #12

I'm all about this but what about third party static sites like everything on Github Pages? We're using Github to host http://kili.io which has all of our marketing material but there's no way to upload a certificate there. I'd rather not move off of Github Pages for the main site because it's easy to just push changes, it's fast, it makes it easy to tie into the rest of our open code ( https://github.com/kili ), and…

You could use a CDN like CloudFlare or CloudFront to proxy and add in SSL
Post reply on HN