HTTPS as a ranking signal • Hacker News Board

Re: HTTPS as a ranking signal

#141

Post by ldng » Thu, Aug 07, 2014, 3:49 PM UTC

drsintoma wrote: post #45

I'm surprised by the amount of negative comments. Independently of what do you think about HTTPS and CAs in general. Given there the alternative currently is plain text, I'm actually surprised that it wasn't a signal before.

I see this has negative for several reasons :

* Certificates are expensive (to buy _and_ to manage)

* Crypto is hard and there will be a lot of screw up with inadequate certs in the wild for a long time. Just having a certificate does not mean much if it weak or broken.

* Can't help the feeling it's an indirect push for cloud business hence possibly eating the margin of freelancers / ISV

* Security Theatre : a lot of critical information for business still transit by email. Will Google force encrypted emails for the greater good ? I don't think so.

Re: HTTPS as a ranking signal

#142

Post by look_lookatme » Thu, Aug 07, 2014, 4:09 PM UTC

icebraining wrote: post #140

look_lookatme wrote: post #133

Earlier quoted context omitted.

Link? The numbers I see for this service are: "Base certificate costs $165.00 for three domains" "After the third domain, each additional domain costs just $45.00" http://www.positivessl.com/multi_domain_ssl_certificate.php

https://www.namecheap.com/security/ssl-certificates/comodo/p...

Thanks!

Re: HTTPS as a ranking signal

#143

Post by scott_karana » Thu, Aug 07, 2014, 4:24 PM UTC

Wow. For those needing to support non-SNI browsers, this is going to become a real IPv4 address land-grab.

IPv6 is disturbingly uncommon still...

Re: HTTPS as a ranking signal

#144

Post by d0ugie » Thu, Aug 07, 2014, 4:58 PM UTC

Perhaps more people would be more inclined to get nudged by Google in this direction if Google got in the CA game and sold certificates themselves, 2048 bit, right on Google Play, Chrome Optimized certs, NFC and QR code-enabled. How about that?

Re: HTTPS as a ranking signal

#145

Post by daurnimator » Thu, Aug 07, 2014, 5:11 PM UTC

Smerity wrote: post #95

RubyPinch wrote: post #82

Earlier quoted context omitted.

the default noted there seems fine? if HTTPS, then GA uses HTTPS, if HTTP, GA uses HTTP with firefox adding in mixed-content-complaining not too long ago [1], along with IE having it for a while, and apparantly chrome having it too, its best to match protocol to minimize issues for the user [1]: https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-bloc...

Browsers only complain if you go from HTTPS=>HTTP, not the other way around, so there is no mixed content warning. The article itself, hosted on Blogger, demonstrates this if you check the source code -- whilst the website is HTTP, it uses JS hosted on HTTPS, with no mixed content issue. To reiterate on the issue with HTTP default, the issue is that Google Analytics being HTTP on all HTTP sites results in a far easie…

If only..... there are numerous browser bugs out there where HTTP=>HTTPS ends with warnings or failures.

e.g. in IE9, see point 7 on http://blogs.msdn.com/b/ieinternals/archive/2010/05/13/xdoma...

Re: HTTPS as a ranking signal

#146

Post by notatoad » Thu, Aug 07, 2014, 5:13 PM UTC

scott_karana wrote: post #143

Wow. For those needing to support non-SNI browsers, this is going to become a real IPv4 address land-grab. IPv6 is disturbingly uncommon still...

supporting non-SNI browsers is less common. Over the last two years i've seen a huge drop off in ie8/XP traffic on my sites.

Re: HTTPS as a ranking signal

#147

Post by eli » Thu, Aug 07, 2014, 5:16 PM UTC

drdaeman wrote: post #87

chmars wrote: post #72

Earlier quoted context omitted.

Another advantage to we masters with money … why? SSL does not come cheap. Certificates have become cheap but you need your own IP, i.e., shared hosting is a problem and hosting becomes more expensive. Certificate sellers, hosters etc. on the other hand are certainly happy about these new business opportunities – although we all know that SSL is inherently broken. OK, probably still better than nothing! :)

> but you need your own IP Not anymore, unless you need to support antiquities like IE7 on Windows XP or some ancient Java-based software. SNI works just fine in other cases.

Check your own stats before you assume you don't still have Win XP/IE users. I have quite a few.

Re: HTTPS as a ranking signal

#148

Post by eli » Thu, Aug 07, 2014, 5:19 PM UTC

notatoad wrote: post #146

scott_karana wrote: post #143

Wow. For those needing to support non-SNI browsers, this is going to become a real IPv4 address land-grab. IPv6 is disturbingly uncommon still...

supporting non-SNI browsers is less common. Over the last two years i've seen a huge drop off in ie8/XP traffic on my sites.

But did it drop to zero? Are you willing to serve those people a big scary error message?

Re: HTTPS as a ranking signal

#149

Post by notatoad » Thu, Aug 07, 2014, 5:27 PM UTC

eli wrote: post #148

notatoad wrote: post #146

Earlier quoted context omitted.

supporting non-SNI browsers is less common. Over the last two years i've seen a huge drop off in ie8/XP traffic on my sites.

But did it drop to zero? Are you willing to serve those people a big scary error message?

it's definitely not zero. as for whether or not i'm willing to serve those people a big scary error message, i'm not sure yet. It's something we're actually going to have to come to a decision on in the next couple weeks though, this isn't a hypothetical for me.

a lot of my traffic is repeat, so we'll probably do a good campaign to push users off IE8 this fall and officially declare it unsupported in Nov/Dec.

Re: HTTPS as a ranking signal

#150

Post by cmg » Thu, Aug 07, 2014, 5:29 PM UTC

ldng wrote: post #139

tristanperry wrote: post #15

Earlier quoted context omitted.

I do agree, however remember that you can get SSL certs from $9 (e.g. from NameCheap). You might be able to pay lower if you shop around too. Also even if it was used as a fairly strong ranking signal, if Google still approach their rankings like they do now, spammers might still have sufficient ranking 'weight' to overcome a lack of SSL certificate.

Don't forget you have to manage your certs. It's an extra burden. Let's say I am a freelancer, I make website for small restaurant. Until now I could make a website with frontpage, menu and gallery put it on a server and be done with it and collect a monthly fee. Now, you have to manage the cert, that is say every year re-issue a new cert and invalidate the old. It adds costs. Without much if any benefits for some cl…

I'm a freelance web developer for dozens of restaurants. They pay for the site, then a yearly hosting fee every year after launch. They get a basic CMS so they can update their hours/menus/etc.

I host all their sites on a few VPS servers. Some of my contracts require support for IE 7 or IE 8 on Windows XP, and those browsers don't support SNI. So in addition to what you've mentioned - maintaining certificates and losing more of what little money I make on hosting (I basically charge a small % of the VPS cost plus a few hours' worth of work), I now will need to figure out another solution. It seems like a waste to spin up a new VPS for each site that requires XP support.

Clients look at the For now though, I'm going to do nothing new. All indications are that HTTPS is going to be maybe 1% of the ranking, and I know my market well enough that the sites rank highly for local searches - which is the important part. They're responsive and they've all got social media presences, so until SSL is more important for PageRank, I'll wait it out.