Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Will Soon Shame All Websites That Are Unencrypted

motherboard.vice.com

Post reply on HN
Print view View original

31–40 of 369 posts

Re: Google Will Soon Shame All Websites That Are Unencrypted

#31

Post by rwmj »

aembleton wrote: post #25
oliv__ wrote: post #23

Why do we have to go through this whole SSL certificates thing and can't just have a simple, automatically secure, I-do-nothing-and-my-website-is-secure protocol? Seriously though. If secure is the default from now on, why can't it actually be the default?

Because you need to create a public key for the browser to use.

SSH gets this right -- create a host key when the server is installed, and have the client check the key and only warn/error when it changes. Sure, this isn't super-secure for first time visitors to their banking website or whatever, but those websites can continue to use the current system.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#32

Post by geofft »

oliv__ wrote: post #23

Why do we have to go through this whole SSL certificates thing and can't just have a simple, automatically secure, I-do-nothing-and-my-website-is-secure protocol? Seriously though. If secure is the default from now on, why can't it actually be the default?

Isn't that what Let's Encrypt is aiming for? Install a package, which configures a cronjob for you?

https://letsencrypt.org/howitworks/

Which could just even become a default but optional dependency of your distro's web server package, or part of your Docker container, or whatever.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#33

Post by kpcyrd »

josteink wrote: post #9

Yeah. Still not paying for a cert on my person home-pages just so I can have my own page come up first when people google my (worldwide unique) name. That page contains static HTML and does not need SSL, and it's not "insecure" just because you may be on a network which MITMs traffic. That makes your network insecure, not my page. So yeah. Not interesting. Not worth it.

Please read the article, this isn't about google the search engine, it's about google the browser vendor. Firefox nightly is doing the same already by default.

I'm always wondering if there's a correlation between the relevance of integrity for a site and the relevance of the site itself.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#37

Post by ossreality »

oliv__ wrote: post #23

Why do we have to go through this whole SSL certificates thing and can't just have a simple, automatically secure, I-do-nothing-and-my-website-is-secure protocol? Seriously though. If secure is the default from now on, why can't it actually be the default?

.... oh boy. I laughed, cringed, shook my head.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#39

Post by geofft »

SFjulie1 wrote: post #28

Yes, shame all libraries/swimming pools giving their schedule online without HTTPS. Shame gutenberg project, the documentations for OS, code, your washing machine. Why would money from libraries gutenberg project, NGOs informations go to more expansive OPEX for web hosting when an information is clearly designed and OK to be public? And does not require adds or payment. Google has some godwin point very authoritative…

What additional money is needed to implement HTTPS? It's like an afternoon of a sysadmin's time; it doesn't require any more opex.

If you have a favorite library or NGO that doesn't support HTTPS for lack of funding, I am personally happy to donate an afternoon's of a sysadmin's wages to them. (Or to set it up for them, honestly.)

Project Gutenberg is already over HTTPS, so I'm not sure what you mean by that. If you think they were strongarmed by Google into it, instead of having decided this long ago as a simple and obvious step for the good of their mission, a reference for that would help inform the discussion.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#40

Post by windsurfer »

joshstrange wrote: post #30
aembleton wrote: post #24

Earlier quoted context omitted.

How does it get rid of competing ad networks? Does Google have a monopoly on serving ads over HTTPS?

For one IIRC it kills referer headers and so search engines/ad networks can't build out a graph of where a user was prior. Google OTOH sends the majority of the traffic and it's reach in ads allows it fill in the gaps better than any other network.

HTTPS does not kill referrer or referer headers. See https://referer.rustybrick.com/
Post reply on HN