Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS as a ranking signal

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

31–40 of 212 posts

Re: HTTPS as a ranking signal

#31

Post by [deleted] »

BorisMelnik wrote: post #22

Don't have a ton of experience with SSL and only recently started messing with TLS on my Apache server but question: Google makes mention of a 2048 bit certificate but most of the certificates I see are 128/256. Is this number referring to something else other than the strength of the encryption?

[deleted]

Re: HTTPS as a ranking signal

#32

Post by spacefight »

joesavage wrote: post #25
etherealG wrote: post #20

Earlier quoted context omitted.

That 100% static site can be monitored. Which pages you visit on it and what that says about you. Privacy is always valuable.

I'm not sure about "always". I run a site that provides counter information for League of Legends ( http://www.championcounter.com/ ) and I doubt very much my users will benefit at all from me moving over to HTTPS.

Sure they would benefit. They could check whatever is on your site without anyone in between noticing (WLAN e.g. at starbucks, corporate LANs and the proxies used etc etc). There are companies out there, who buy surf-habits (read: browsing logs of URLs visited) and mine it for valuable data.

Encrypt.

Re: HTTPS as a ranking signal

#34

Post by asperous »

joesavage wrote: post #25
etherealG wrote: post #20

Earlier quoted context omitted.

That 100% static site can be monitored. Which pages you visit on it and what that says about you. Privacy is always valuable.

I'm not sure about "always". I run a site that provides counter information for League of Legends ( http://www.championcounter.com/ ) and I doubt very much my users will benefit at all from me moving over to HTTPS.

A lot of work routers might flag that site url as "GAMING" and with too much use could potentially contribute to someone losing their job.

Also some isps have been caught injecting ads into plain text web sites [1]. Do you want more ads on your site that you didn't put there?

[1] http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injec...

Re: HTTPS as a ranking signal

#35

Post by BorisMelnik »

ckuehl wrote: post #30
BorisMelnik wrote: post #22

Don't have a ton of experience with SSL and only recently started messing with TLS on my Apache server but question: Google makes mention of a 2048 bit certificate but most of the certificates I see are 128/256. Is this number referring to something else other than the strength of the encryption?

Messages like "your connection is encrypted with 256-bit encryption" don't tell you anything about the size of the RSA keys in use. During the TLS handshake, your browser and the server do public-key crypto to authenticate each other and share private information without a previously-known shared secret. Because public-key crypto is really, really slow, they then share a small secret (say, 128 or 256 bits), and use t…

thank you both, that really makes sense. I thought it was a little peculiar that Google decided to mention the whole 2048 bit thing, I couldn't have been the only one that was thrown off by that a bit.

Re: HTTPS as a ranking signal

#36

Post by hsivonen »

BorisMelnik wrote: post #22

Don't have a ton of experience with SSL and only recently started messing with TLS on my Apache server but question: Google makes mention of a 2048 bit certificate but most of the certificates I see are 128/256. Is this number referring to something else other than the strength of the encryption?

2048 is the RSA key size. 128 or 256 is the AES key size (or more generally the key size for the symmetric cipher). Nowadays the latter doesn't depend on the cert, but in the 90s it artificially did thanks to U.S. export policy. CAs still advertise as if we were stuck in the 90s.

Re: HTTPS as a ranking signal

#38

Post by mkal_tsr »

kmfrk wrote: post #28

This is great, but it should also be a reminder that SSL is currently not possible for custom domains hosted on GitHub: https://konklone.com/post/github-pages-now-supports-https-so... . I hope a solution materializes eventually.

Now you can contact Github with this announcement and voice your concerns. Now they have more incentive to change it (if people actively voice their issues to Github).

Re: HTTPS as a ranking signal

#39

Post by bdamm »

sorbits wrote: post #23

Would be more awesome if they offered free certificates and an API to renew them. Right now enabling https is not a one-time investment, since a new certificate has to be requested and installed each time the old one expires. Computers are supposed to bring down cost and automate tedious tasks, for https the opposite is the case. It’s worth mentioning that https://www.startssl.com/ does offer free certificates. But w…

The SSL CA model is deeply flawed, so it bothers me that I have to pay into this broken cartel.

An effective social network for website trust, combining cryptographic assurances with trust networks that already exist, is my dream.

(Edit: Clarify that the SSL CA model is flawed for the Internet at large, but has many useful applications elsewhere.)

Re: HTTPS as a ranking signal

#40

Post by BorisMelnik »

Just doing a little more research. It appears as though many of these EV certs require you to verify your company information, domain registration, phone number and even address. With Google using however many hundred or thousand ranking signals, this makes sense. It is essentially another layer of trust and really great for UX as well. Online shoppers trust a site with the "green location bar" much more than ones without it, and I could definitely see how Google might reward this type of website.
Post reply on HN