Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Will Soon Shame All Websites That Are Unencrypted

motherboard.vice.com

Post reply on HN
Print view View original

271–280 of 369 posts

Re: Google Will Soon Shame All Websites That Are Unencrypted

#271

Post by billhathaway »

mholt wrote: post #96

In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: https://caddyserver.com - It also redirects HTTP -> HTTPS.[1] There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted…

I tried out caddyserver about an hour ago, and the ease of use is awesome. Had it serving my domain with a letsencrypt auto-generated cert in 2 minutes from never having looked at the caddy docs before.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#272

Post by BogusIKnow »

Main problem still is Google: They consider HTTPS and HTTP links the same. When switching a site to HTTPS you lose all your incoming links. Redirects only transfer a small amount of juice. You're toast.

We tried migrating several times to HTTPS only, every time got a huge penalty from Google.

So Google is the main driver for HTTP websites.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#273

Post by Nullabillity »

Dylan16807 wrote: post #257
Nullabillity wrote: post #101

Earlier quoted context omitted.

That's per IP, you're also limited to 5 requests per domain name per week. In my case, I have a bunch of subdomains for various stuff that all counts against the limit for the main website. I suppose I ought to combine the CSRs, but implementing that makes it a bit more complex than just automatically requesting a certificate per nginx vhost.

>you're also limited to 5 requests per domain name per week Huh, I'm pretty sure I used more than that when I was first setting it up with no problems.

To quote the website:

> Certificates/Domain you could run into through repeated re-issuance. This limit measures certificates issued for a given combination of Public Suffix + Domain (a "registered domain"). This is limited to 5 certificates per domain per week.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#274

Post by mynameisvlad »

pollen23 wrote: post #240
mynameisvlad wrote: post #231

Earlier quoted context omitted.

One of the reasons a country has feminine gender is the association with the mother land (ie. one's native country).

Not all countries have feminine gender, just check https://en.wikipedia.org/wiki/Fatherland

In their native tongues, sure. But we're not talking about Afrikaans or French, we're talking about English. And since Britannia is feminine, English would have developed with the word "motherland" representing the native country.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#275

Post by pfg »

Dylan16807 wrote: post #257
Nullabillity wrote: post #101

Earlier quoted context omitted.

That's per IP, you're also limited to 5 requests per domain name per week. In my case, I have a bunch of subdomains for various stuff that all counts against the limit for the main website. I suppose I ought to combine the CSRs, but implementing that makes it a bit more complex than just automatically requesting a certificate per nginx vhost.

>you're also limited to 5 requests per domain name per week Huh, I'm pretty sure I used more than that when I was first setting it up with no problems.

If SAN certificates make sense for your setup (i.e. all used on the same server or for the same service), you can have up to 100 (sub)domains on one certificate, or basically 500 per week.

Maybe that's how you managed to get more than 5.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#276

Post by mynameisvlad »

yeukhon wrote: post #246
mynameisvlad wrote: post #231

Earlier quoted context omitted.

One of the reasons a country has feminine gender is the association with the mother land (ie. one's native country).

But if you have a child company, wouldn't you expect to associate the parent company with a feminine gender before a masculine gender? That's what I am getting at. An organization has that "motherland" feel in some way.

Not really, no. Motherland is a very specific term that's been ingrained into English most likely because of the close personal relationship between people and their native countries, which would have been Britannia for many English speakers when the language was developing. There isn't really that same deep and universal connection when talking about organizations, so a similar term probably wouldn't develop anytime soon.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#277

Post by Dylan16807 »

pfg wrote: post #275
Dylan16807 wrote: post #257

Earlier quoted context omitted.

>you're also limited to 5 requests per domain name per week Huh, I'm pretty sure I used more than that when I was first setting it up with no problems.

If SAN certificates make sense for your setup (i.e. all used on the same server or for the same service), you can have up to 100 (sub)domains on one certificate, or basically 500 per week. Maybe that's how you managed to get more than 5.

I did a bunch of requests starting with one subdomain, then a second, adding SANs multiple times, setting a cron to do one request a month and testing it, then adding yet one more SAN to the list.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#278

Post by mintplant »

lambau wrote: post #269
icebraining wrote: post #174

Earlier quoted context omitted.

Then maybe those platforms will finally implement it. In any case, there's an alternative: putting Cloudflare in front of the site. In fact, Google shows me a guide to do so when I search for "squarespace ssl". Of course, that's hardly as secure as end-to-end HTTPS, but still, I trust the path between CF and SquareSpace much more than between the user's browser and SquareSpace.

Please do not put Cloudflare in front of your site. It makes it impossible for tor and VPN users to view your site since they have to solve an impossible captcha to even see the static content.

It's possible to turn off security in the CloudFlare control panel. I think the bigger issue is that CloudFlare has become a single point of interception for MITM'ing huge portions of web traffic.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#280

Post by robin_reala »

nodamage wrote: post #230
cryptoz wrote: post #187

Earlier quoted context omitted.

I do have the app. And that fact makes this double-annoying. When trying to visit a website, I'm told not to do that. That would be annoying on its own, and in fact it was for the first few years that it happened. But that's not at all what is frustrating me right now. What's super annoying is that Google claimed last year that they would penalize websites that do this, because they find it annoying too. Except they…

> I do have the app. And that fact makes this double-annoying. It really just shows the sad state of mobile advertising when they're showing you ads for an app you already have.

On the other hand, I like that websites are unable to query my phone to find out what apps I have installed.
Post reply on HN