Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Will Soon Shame All Websites That Are Unencrypted

motherboard.vice.com

Post reply on HN
Print view View original

121–130 of 369 posts

Re: Google Will Soon Shame All Websites That Are Unencrypted

#121

Post by magicalist »

cryptoz wrote: post #76
donohoe wrote: post #64

Which is hilarious because the reason I can't switch The New Yorker website to HTTPS is because of ads - which I'm getting from Google DFP which allows non-secure ad assets. In short; Google will penalize me because I use Google. The universe has a sense of humor.

Similarly, Google claimed they would start penalizing websites that showed full-page ads for mobile apps instead of showing you the website. But every single time I try to get to Gmail, or Drive, or Calendar, or any Google service on the web using a mobile device, I'm shown a full page ad for a mobile app. Google has been doing this for years, and it seems like it's also been a year since they said they'd punish all…

> First results for searching 'calendar': http://i.imgur.com/l3A5Wlh.png

Well in your screenshot it seems like you scrolled down on the "calendar" search results. I get some other random thing ahead of Google Calendar, in incognito or not.

It is really annoying (I too hate those things, I would have installed the app if I wanted the app), but the click through thing only happens once in my testing. Are you clearing your cookies regularly?

Re: Google Will Soon Shame All Websites That Are Unencrypted

#122

Post by n3t »

plasticxme wrote: post #115
mholt wrote: post #96

In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: https://caddyserver.com - It also redirects HTTP -> HTTPS.[1] There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted…

This is an awkward argument. One of my sites documents how to configure servers, for example. What excuse is there that something like that needs to be encrypted? The most legitimate reason I've heard is for privacy. I don't believe the gov't is going to lock someone up for learning how to serve web pages.

Using HTTP instead of HTTPS allows an evil ISP injecting, for example, ads into your website or modifing its content in any way while serving it.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#123

Post by krapp »

plasticxme wrote: post #115
mholt wrote: post #96

In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: https://caddyserver.com - It also redirects HTTP -> HTTPS.[1] There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted…

This is an awkward argument. One of my sites documents how to configure servers, for example. What excuse is there that something like that needs to be encrypted? The most legitimate reason I've heard is for privacy. I don't believe the gov't is going to lock someone up for learning how to serve web pages.

>I don't believe the gov't is going to lock someone up for learning how to serve web pages.

That's essentially the same as not locking your car doors because you feel your car isn't worth breaking into.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#124

Post by kuschku »

wbillingsley wrote: post #103
kuschku wrote: post #92

Earlier quoted context omitted.

Even better. Put the public key in DNS, auth the DNS.

I thought about that, but there's so many DNS caches out there with potential bugs to make them insecure and poisonable. But a set of public keys from the registrar is "content". It's small, so they could just have a server or two to handle it. (But if load/latency was an issue, well everyone's pretty good at content-distribution networks these days...)

Well, if someone can manipulate your DNS, you have other issues than your SSL certificate anyway.

Ideally, DNS should be signed by your registrar.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#125

Post by cryptoz »

magicalist wrote: post #121
cryptoz wrote: post #76

Earlier quoted context omitted.

Similarly, Google claimed they would start penalizing websites that showed full-page ads for mobile apps instead of showing you the website. But every single time I try to get to Gmail, or Drive, or Calendar, or any Google service on the web using a mobile device, I'm shown a full page ad for a mobile app. Google has been doing this for years, and it seems like it's also been a year since they said they'd punish all…

> First results for searching 'calendar': http://i.imgur.com/l3A5Wlh.png Well in your screenshot it seems like you scrolled down on the "calendar" search results. I get some other random thing ahead of Google Calendar, in incognito or not. It is really annoying (I too hate those things, I would have installed the app if I wanted the app), but the click through thing only happens once in my testing. Are you clearing y…

I scrolled down because the top of the page was a Google Ad for Google Calendar. I chose to show the first organic result. Here's the top of the page: http://imgur.com/cO84ogZ.png

Re: Google Will Soon Shame All Websites That Are Unencrypted

#126

Post by lol768 »

plasticxme wrote: post #115
mholt wrote: post #96

In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: https://caddyserver.com - It also redirects HTTP -> HTTPS.[1] There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted…

This is an awkward argument. One of my sites documents how to configure servers, for example. What excuse is there that something like that needs to be encrypted? The most legitimate reason I've heard is for privacy. I don't believe the gov't is going to lock someone up for learning how to serve web pages.

Keep in mind you're also ensuring the integrity of the document is kept and the user has (to some degree) a good idea that the document is actually from you. Confidentiality is only one aspect. I think a couple of ISPs in the US were injecting ads/content at one point into pages served over HTTP.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#127

Post by plasticxme »

darkhorn wrote: post #46

Several weeks ago I have installed certificate to my web site on NGINX and it wasn't hard. It was fun to do. Also I got A+ from Qualys SSL Labs. What I mean is it is easy to deploy an HTTPS site.

Deploying TLS in simple environments isn't overly complicated. It's just cost prohibitive.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#129

Post by mc_hammer »

0x4a42 wrote: post #3
mc_hammer wrote: post #2

bingo check and mate TLS Certificate MITM Is now the fucking de-facto crypto thats the end of the story as far as ssl/tls security goes.. you wont hear about it anymore. and if you dont have it you are not trustworthy. thats it. no objections. no court hearing. youre just done. (its probably a good time to bring up the W3C president states this is not https3 this is tls labeled as https. and the 4 show stopping bugs…

Sorry?

anyone who does drugs could be a serial killer!! you are not safe to try any other drugs!! here inject these mercuries and aluminumummies!!

for your safety we have hidden all posts below the bernie sanders TLS threshold

Re: Google Will Soon Shame All Websites That Are Unencrypted

#130

Post by jacobr1 »

betenoire wrote: post #114
EGreg wrote: post #108

Earlier quoted context omitted.

Here's a good excuse for not using https for everything: it breaks caching of files by proxies!

Right. So what's the solution? I run my wife's retail website. Am I supposed to just stop worrying about caching static assets like product images, scripts, etc.? Do I just throw my hands in the air and assume it evens out because I switched to HTTPS? Serious question, what are my options?

* Ensure your server is setting ETags correctly so the clients can determine which assets they need to re-request.

* Make use of edge CDNs with https termination

Post reply on HN