Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS as a ranking signal

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

181–190 of 212 posts

Re: HTTPS as a ranking signal

#181

Post by oceanstone »

rwhitman wrote: post #175
pierrefar wrote: post #53

I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere. Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner: 1. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How man…

So Google's position is that SSL is such a high priority for content sites that they will officially incite a mad scramble for every content site on the planet from big media companies to hobby blogs to secure their page behind https to keep their ranking, but yet doesn't see anything wrong with the fact that every Blogger blog and even the Google Online Security Blog that it is announced on, is insecure. Nice.

"A journey of a thousand miles begins with a single step"

Re: HTTPS as a ranking signal

#182

Post by arikrak »

After you buy an SSL certificate, Heroku charges $20/month to use it. You can circumvent this with Cloudflare, but they also charge $20/month for SSL. Is there any easy way to use SSL on Heroku for $0-5 / month?

(See http://www.quora.com/Is-there-any-way-to-use-HTTPS-on-Heroku... for one possibility.)

Re: HTTPS as a ranking signal

#183

Post by cpeterso »

dserodio wrote: post #167
btian wrote: post #158

Earlier quoted context omitted.

Self-signed is worse than not having one. Don't do that.

Why? The crypto is just as strong with a self-signed cert as a "name brand" cert. The only downside is teaching users to ignore SSL errors, which is bad.

The crypto strength of a self-signed cert is irrelevant because a MITM can generate their own self-signed cert with the your website's name.

Re: HTTPS as a ranking signal

#184

Post by Wilya »

icebraining wrote: post #113
nulltype wrote: post #102

Earlier quoted context omitted.

Except with the most popular version of Python

Works fine if you use requests, or any other HTTP library which hasn't been left to rot like the one in the 2.x stdlib.

Out of the box, requests on Python2.7 doesn't support SNI.

It is documented, and all you have to do is install additional packages to enable it, but still, that's not automatic.

Re: HTTPS as a ranking signal

#185

Post by chx »

chmars wrote: post #106
drdaeman wrote: post #87

Earlier quoted context omitted.

> but you need your own IP Not anymore, unless you need to support antiquities like IE7 on Windows XP or some ancient Java-based software. SNI works just fine in other cases.

OK, good to know – although there are apparently still some restrictions according to comments by other HN users. SSL is still more expensive, though. For most small content websites ( Example: Shared hosting with 4 WordPress blogs, SSL is active but only to access the control panel since the hoster allows SSL only for one domain. Costs incl. a cheap SSL certificate: 110 USD/year. All 4 WordPress blogs with SSL, i.e.…

> a shared hosting is sufficient with costs of maybe around 100 USD/year

Galopping gargoyles, where do you host that shared costs you $100? A small VPS costs half.

Re: HTTPS as a ranking signal

#186

Post by cpeterso »

Tomte wrote: post #54

It probably bugs me the way it does, because this "signal" has nothing to do with the contents or the usability of the web site (unlike speed, validity of HTML or, well, content itself), but is purely a "we just think you should do X" situation.

HTTPS is relevant to the content because it will ensure that Google's search results direct users to the same content providers seen by Google's web crawlers.

Re: HTTPS as a ranking signal

#187

Post by Scoundreller »

Google has a strong case to have HTTPS implemented:

It prevents ISPs etc. from being able to profile your traffic, but not Google's, since you're probably visiting a site with Adsense or Analytics running on it anyway.

Through HTTPS, Google is the only one with a profile of your traffic, and your ISP is no longer a competitor to them.

Re: HTTPS as a ranking signal

#188

Post by dwd »

drdaeman wrote: post #87
chmars wrote: post #72

Earlier quoted context omitted.

Another advantage to we masters with money … why? SSL does not come cheap. Certificates have become cheap but you need your own IP, i.e., shared hosting is a problem and hosting becomes more expensive. Certificate sellers, hosters etc. on the other hand are certainly happy about these new business opportunities – although we all know that SSL is inherently broken. OK, probably still better than nothing! :)

> but you need your own IP Not anymore, unless you need to support antiquities like IE7 on Windows XP or some ancient Java-based software. SNI works just fine in other cases.

The shortage of IPv4 addresses and the horribly slow adoption of IPv6 is a big issue.

SNI works fine, but when it doesn't it fails horribly. Apache defaults to the first vhost on an IP which can result in non-SNI clients being redirected to the wrong site.

As for XP/IE7 usage, I have a client in an aerospace related industry with most of their customers still on XP/IE7.

Re: HTTPS as a ranking signal

#189

Post by dchest »

nulltype wrote: post #102
drdaeman wrote: post #87

Earlier quoted context omitted.

> but you need your own IP Not anymore, unless you need to support antiquities like IE7 on Windows XP or some ancient Java-based software. SNI works just fine in other cases.

Except with the most popular version of Python

It will be available in the future maintenance release http://legacy.python.org/dev/peps/pep-0466/
Post reply on HN