Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Will Soon Shame All Websites That Are Unencrypted

motherboard.vice.com

Post reply on HN
Print view View original

301–310 of 369 posts

Re: Google Will Soon Shame All Websites That Are Unencrypted

#301

Post by voyou »

tdkl wrote: post #132
SanderMak wrote: post #16

So is there already a solution for https on Github Pages with a custom domain?

Stumbled upon Kloudsec here on HN couple days ago [1] and gave it a go. The dashboard is a bit clunky where you kinda have to figure out what to do, but HTTPS works without needing to move the DNS to them, as in case of Cloudflare (which costs 20$ when moving from Gandi). Basically register account, enter your domain, update your DNS records with an A (replacing the Github pages IP) and TXT record (for verification).…

I'm not sure what you mean about Gandi charging $20 to move the DNS to Cloudflare? I'm using Cloudflare to add HTTPS to a website on a domain registered with Gandi, and it hasn't cost me anything above the usual domain registration fee.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#302

Post by gabemart »

BogusIKnow wrote: post #272

Main problem still is Google: They consider HTTPS and HTTP links the same. When switching a site to HTTPS you lose all your incoming links. Redirects only transfer a small amount of juice. You're toast. We tried migrating several times to HTTPS only, every time got a huge penalty from Google. So Google is the main driver for HTTP websites.

> They consider HTTPS and HTTP links the same. When switching a site to HTTPS you lose all your incoming links.

Do you mean that they don't consider HTTPS and HTTP the same? Otherwise, I don't understand your point here.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#303

Post by lambau »

plasticxme wrote: post #115
mholt wrote: post #96

In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: https://caddyserver.com - It also redirects HTTP -> HTTPS.[1] There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted…

This is an awkward argument. One of my sites documents how to configure servers, for example. What excuse is there that something like that needs to be encrypted? The most legitimate reason I've heard is for privacy. I don't believe the gov't is going to lock someone up for learning how to serve web pages.

Consider Tor: in this case, your "ISP" is a random server on the internet. Maybe your Comcast or TimeWarner ISPs will not be malicious, but with Tor, any one in the world can register to be an exit node/ISP. HTTPS helps protect you from attacks in this "random ISP" model.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#304

Post by lambau »

josteink wrote: post #9

Yeah. Still not paying for a cert on my person home-pages just so I can have my own page come up first when people google my (worldwide unique) name. That page contains static HTML and does not need SSL, and it's not "insecure" just because you may be on a network which MITMs traffic. That makes your network insecure, not my page. So yeah. Not interesting. Not worth it.

> That makes your network insecure, not my page.

Sometimes you NEED to use an insecure network due to censorship (example: Tor or VPN).

Re: Google Will Soon Shame All Websites That Are Unencrypted

#305

Post by tdkl »

voyou wrote: post #301
tdkl wrote: post #132

Earlier quoted context omitted.

Stumbled upon Kloudsec here on HN couple days ago [1] and gave it a go. The dashboard is a bit clunky where you kinda have to figure out what to do, but HTTPS works without needing to move the DNS to them, as in case of Cloudflare (which costs 20$ when moving from Gandi). Basically register account, enter your domain, update your DNS records with an A (replacing the Github pages IP) and TXT record (for verification).…

I'm not sure what you mean about Gandi charging $20 to move the DNS to Cloudflare? I'm using Cloudflare to add HTTPS to a website on a domain registered with Gandi, and it hasn't cost me anything above the usual domain registration fee.

Hm yeah, after reviewing the transfer policies, I guess I mistakenly thought the price for transfer TO Gandi stands for transfer FROM as well. It's still a bit more hassle then what Kloudsec offers.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#306

Post by SystemOut »

michaelt wrote: post #298
SystemOut wrote: post #216

Earlier quoted context omitted.

Google DFP allows it because publishers (e.g. the New Yorker) aren't ready to switch all their traffic HTTPS. If they wanted to they could turn the switch and be HTTPS and tell DFP to only serve secure creatives. One of the larger difficulties for publishers is that many of the 3rd party SSPs aren't ready to go full HTTPs and so publishers are reluctant to make the switch because it reduces demand sources. Disclaimer…

One of the larger difficulties for publishers is that many of the 3rd party SSPs aren't ready to go full HTTPs Right, but Google can motivate or improve the third-party advertisers to update much more effectively than publishers can - just Google hasn't chosen to do that yet. It would be easy to proxy http-only ads from through a CDN that added encryption. Or to charge a premium to http-only ad networks, and ramp the…

How do you think Google can motivate 3rd party advertisers? I'm talking about the Rubicons, Pubmatics, etc. Google doesn't have any real leverage over them. Other than the fact that as publishers do move to SSL (because of the SEO penalty that non SSL sites have) they won't use the SSPs that don't demand or can't insure 100% SSL for their buyers. So in effect Google is putting pressure on them to do it.

I don't understand your next part at all. Who would charge a premium to http only networks? Those sites don't actually rely on Google for delivery.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#307

Post by josteink »

bobby_9x wrote: post #62
windsurfer wrote: post #40

Earlier quoted context omitted.

HTTPS does not kill referrer or referer headers. See https://referer.rustybrick.com/

..so why are all of the search terms suddenly gone from google searche referer headers? Which happened at the same time google defaulted to https?

> ..so why are all of the search terms suddenly gone from google searche referer headers? Which happened at the same time google defaulted to https?

Not related to HTTPS at all. This happened completely independently. It happened because Google went from having search URLs like this

    https://google.com/?q=term
To

    https://google.com/#q=term
And the things after the anchor-mark is never in your referer. Effectively this means that the only tool on the planet who knows what people searched for before entering your site is... Google Analytics.

As a website owner you're basically being co-erced into letting Google snoop on your users, at least if you want to know how they entered your site. And the fact of the matter that is most (all?) companies are willing to make that trade-off.

All in all pretty sad and very creepy.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#308

Post by mark_lee »

cryptoz wrote: post #76
donohoe wrote: post #64

Which is hilarious because the reason I can't switch The New Yorker website to HTTPS is because of ads - which I'm getting from Google DFP which allows non-secure ad assets. In short; Google will penalize me because I use Google. The universe has a sense of humor.

Similarly, Google claimed they would start penalizing websites that showed full-page ads for mobile apps instead of showing you the website. But every single time I try to get to Gmail, or Drive, or Calendar, or any Google service on the web using a mobile device, I'm shown a full page ad for a mobile app. Google has been doing this for years, and it seems like it's also been a year since they said they'd punish all…

The fact is they did penalize themselves for couple of times in history.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#309

Post by realusername »

mholt wrote: post #232
realusername wrote: post #116

Earlier quoted context omitted.

Sorry but I actualy can't load the website because of an HTTPS error (Firefox 43/Linux) (Error code : sec_error_ocsp_old_response).

I just downloaded and installed Firefox 44 today and it works great. Clear your cache?

So I've updated to Firefox 44 and it works indeed but it seems broken on Firefox 43.* on both of my computers (work and personal), you might want to have a look at it since 43.* is a quite recent version. (I'm not the one who downvoted you).

Re: Google Will Soon Shame All Websites That Are Unencrypted

#310

Post by id »

nostalgiac wrote: post #288
nodamage wrote: post #230

Earlier quoted context omitted.

> I do have the app. And that fact makes this double-annoying. It really just shows the sad state of mobile advertising when they're showing you ads for an app you already have.

Sad state? How do you expecet them to know all the apps installed on your phone? And if they DID know this information, people would be up in arms about privacy or lack there-of.

If they don't know it, they shouldn't make assumptions.
Post reply on HN