Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS as a ranking signal

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

191–200 of 212 posts

Re: HTTPS as a ranking signal

#191

Post by xyzzy123 »

richbradshaw wrote: post #119
xyzzy123 wrote: post #68

Earlier quoted context omitted.

... after the first visit...

Unless your site is on the HSTS list ( https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr... for Chrome, Firefox use the same list by verifying by connecting via HTTPS and checking for a long HSTS time.)

Right, unless your site is on the HSTS list AND all your users are using Chrome or firefox....

Which was basically my original point, which is that if you want your site to be generally accessible by just typing in the domain name, you still can't just turn off port 80...

Which I guess is why google.com itself is still reachable on port 80.

Re: HTTPS as a ranking signal

#192

Post by heroh »

icebraining wrote: post #50
hosay123 wrote: post #26

I'm sorry, but this simply isn't something a search engine should be dictating. Turning enabling SSL into some arms race that panics small businesses into buying millions of new, pointless certificates just isn't very fair. This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works - and h…

This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works I don't see how is this any different from any other signal that Google uses to prioritize sites. Forcing small businesses to buy certificates doesn't seem any different than forcing them to have faster websites, for example. There…

>any other signal that Google uses to prioritize sites

they don't just own the signals and sites... the own access to data about your digital life and their algorithms process it as another signal in mining your life.

Google said "don't be evil":

http://www.reuters.com/article/2014/04/25/us-apple-google-la...

Re: HTTPS as a ranking signal

#193

Post by ksk »

I don't buy the 'this is for your own safety' nonsense. Having said that, when are Google going to improve their search algorithm? These days there are so many shitty content farm results that clog up the first page itself. How about improving that first?

Unfortunately, Google is pretty much a monopoly when it comes to online advertising and search that few companies will have a choice in this matter. Google unilaterally forcing them to buy stuff doesn't sit well with me.

Re: HTTPS as a ranking signal

#194

Post by speleding »

cbr wrote: post #172
speleding wrote: post #110

Earlier quoted context omitted.

The Google blog says that TLS is a (presumably positive) ranking signal, they do not state whether leaving the site available unencrypted is a negative signal. Until they clear up that ambiguity it seems risky to go TLS only for exactly the reason you cite.

If X is a positive signal, then not-X is a negative signal.

That does not follow logically. not-X is typically zero, just like not having an inbound link from a high pagerank page is not a negative. Besides, there are three situation: no-https, both http/https and http-only, which makes your claim that the middle one is negative seem less likely.

Re: HTTPS as a ranking signal

#195

Post by madaxe_again »

tootie wrote: post #163
madaxe_again wrote: post #104

Earlier quoted context omitted.

Sorry to jump in with a tangential reply, but BEWARE of the following! Google treat the http and https versions of a domain as SEPARATE PROPERTIES. This means that even if you 301 every http page to https when you transition, all of your current rankings and pagerank will be irrelevant. You can verify this behaviour for yourself in webmaster tools. I suppose this is because it's possible to serve up different content…

The IO talk covers this. There's a few steps involved beyond just sending a 301 such as putting a rel=canonical on the https site.

Yeah, did everything that's possible within the document - although a few steps (Change Of Address) are actually impossible - GWT disallows it within the same domain. Still, SEO in the can.

Re: HTTPS as a ranking signal

#197

Post by mike_hearn »

hosay123 wrote: post #26

I'm sorry, but this simply isn't something a search engine should be dictating. Turning enabling SSL into some arms race that panics small businesses into buying millions of new, pointless certificates just isn't very fair. This kind of policy needs to be discussed openly in a suitable forum, e.g. the IETF, not handed down to us by a single company who think they have a right to dictate how the Internet works - and h…

> At a time when OpenSSL just suffered one of its worst bugs in history, forcing small sites to assume the risk of running code like this, which they inevitably will get wrong, materially worsens security for all, it doesn't improve it.

OpenSSL is not the only SSL stack you know. I run one of my websites on Tomcat so I can benefit from the pure-Java TLS stack it uses (the default one actually). Something like heartbleed is impossible for such a stack.

Re: HTTPS as a ranking signal

#198

Post by iancarroll »

icebraining wrote: post #117
diafygi wrote: post #108

Earlier quoted context omitted.

What about a kickstarter to subsidize SSL costs? Or how about one to buy a root CA and make it free?

There is already a community-driven CA: http://www.cacert.org/ The problem is that it's not only about money. You need to follow certain procedures or browsers and OSs won't include your root certificate.

I don't think anyone has confidence in CACert anymore. IIRC they bombed their internal audit...

Re: HTTPS as a ranking signal

#199

Post by iancarroll »

jamesbritt wrote: post #165
tristanperry wrote: post #15

Earlier quoted context omitted.

I do agree, however remember that you can get SSL certs from $9 (e.g. from NameCheap). You might be able to pay lower if you shop around too. Also even if it was used as a fairly strong ranking signal, if Google still approach their rankings like they do now, spammers might still have sufficient ranking 'weight' to overcome a lack of SSL certificate.

[R]emember that you can get SSL certs from $9 (e.g. from NameCheap). NameCheap provrides a wide range of certs. I'm sure this is true of other SSL-cert offerings. Are they all at least adequate for Google's SEO purposes?

Yes, any certificate sold by them would trigger this "boost".

Re: HTTPS as a ranking signal

#200

Post by iancarroll »

tomjen3 wrote: post #129
watwut wrote: post #109

Earlier quoted context omitted.

They are free to get, but you have to pay money if you need to revoke that certificate.

Which you don't really need to. Sure it disables all the security, but if you only care about the speed boost/cover your ass part it is a non-issue.

Yes, you do. If there is another Heartbleed, your certificate is worthless if someone has the chance to grab it.
Post reply on HN