Google Will Soon Shame All Websites That Are Unencrypted • Hacker News Board

Re: Google Will Soon Shame All Websites That Are Unencrypted

#61

Post by JangoSteve » Wed, Jan 27, 2016, 9:37 PM UTC

SanderMak wrote: post #16

So is there already a solution for https on Github Pages with a custom domain?

In addition to CloudFlare, you can also use AWS CloudFront for this. We just implemented this to get https working on our custom-domain Github Pages site [1] this week.

You first have to upload your SSL certificate to AWS IAM [2] (you only have to do this once, or you can just purchase your certificate from the AWS console now too). Then, all you have to do is create a new CloudFront distribution and point the origin to your subdomain.github.io URL and select your SSL certificate from the drop-down, then point your CNAME record to the CloudFront distribution.

[1] https://os.alfajango.com/

[2] https://bryce.fisher-fleig.org/blog/setting-up-ssl-on-aws-cl...

Re: Google Will Soon Shame All Websites That Are Unencrypted

#62

Post by bobby_9x » Wed, Jan 27, 2016, 9:44 PM UTC

windsurfer wrote: post #40

joshstrange wrote: post #30

Earlier quoted context omitted.

For one IIRC it kills referer headers and so search engines/ad networks can't build out a graph of where a user was prior. Google OTOH sends the majority of the traffic and it's reach in ads allows it fill in the gaps better than any other network.

HTTPS does not kill referrer or referer headers. See https://referer.rustybrick.com/

..so why are all of the search terms suddenly gone from google searche referer headers? Which happened at the same time google defaulted to https?

Re: Google Will Soon Shame All Websites That Are Unencrypted

#63

Post by yeukhon » Wed, Jan 27, 2016, 9:45 PM UTC

mikecb wrote: post #45

gesman wrote: post #26

Google should offer stupid SSL certificates either for free or for $1/yr. Perhaps at least to customers of Google domains. I won't mind switching from namecheap to Google domain in latter case.

They are a platinum sponsor of Letsencrypt, so...done?

That doesn't mean anything other than "we like the idea, you convinced us, we have some budget, we will sponsor in some way money and human resource."

Re: Google Will Soon Shame All Websites That Are Unencrypted

#64

Post by donohoe » Wed, Jan 27, 2016, 9:45 PM UTC

Which is hilarious because the reason I can't switch The New Yorker website to HTTPS is because of ads - which I'm getting from Google DFP which allows non-secure ad assets.

In short; Google will penalize me because I use Google.

The universe has a sense of humor.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#65

Post by ryanlol » Wed, Jan 27, 2016, 9:46 PM UTC

nothrabannosir wrote: post #50

rwmj wrote: post #31

Earlier quoted context omitted.

SSH gets this right -- create a host key when the server is installed, and have the client check the key and only warn/error when it changes. Sure, this isn't super-secure for first time visitors to their banking website or whatever, but those websites can continue to use the current system.

SSH doesn't get this right. It's no better than a (auto-pinned) self-signed cert, in our world. I challenge everyone to find in their extended group of friends and colleagues, and their friends and colleagues, a single person who consistently checks the fingerprint* on every first SSH connection. Id personally have a hard time finding someone who even knows it matters. And if you don't? Mitm can get your password, or…

-o VisualHostKey=yes

Re: Google Will Soon Shame All Websites That Are Unencrypted

#66

Post by ergothus » Wed, Jan 27, 2016, 9:47 PM UTC

gesman wrote: post #26

Google should offer stupid SSL certificates either for free or for $1/yr. Perhaps at least to customers of Google domains. I won't mind switching from namecheap to Google domain in latter case.

Getting a Google domain means giving up getting new features from Google :( (pauses to clean up bitterness)

Re: Google Will Soon Shame All Websites That Are Unencrypted

#67

Post by newjersey » Wed, Jan 27, 2016, 9:49 PM UTC

donohoe wrote: post #64

Which is hilarious because the reason I can't switch The New Yorker website to HTTPS is because of ads - which I'm getting from Google DFP which allows non-secure ad assets. In short; Google will penalize me because I use Google. The universe has a sense of humor.

They're trying to nudge their customers for a while. It is just a little difficult when that's one's biggest source of income.

For example, https://support.google.com/dfp_sb/answer/4515432?hl=en

Re: Google Will Soon Shame All Websites That Are Unencrypted

#68

Post by ultramancool » Wed, Jan 27, 2016, 9:49 PM UTC

yeukhon wrote: post #63

mikecb wrote: post #45

Earlier quoted context omitted.

They are a platinum sponsor of Letsencrypt, so...done?

That doesn't mean anything other than "we like the idea, you convinced us, we have some budget, we will sponsor in some way money and human resource."

It also means they quite literally at least assist with offering free SSL certificates.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#69

Post by Nullabillity » Wed, Jan 27, 2016, 9:49 PM UTC

geofft wrote: post #32

oliv__ wrote: post #23

Why do we have to go through this whole SSL certificates thing and can't just have a simple, automatically secure, I-do-nothing-and-my-website-is-secure protocol? Seriously though. If secure is the default from now on, why can't it actually be the default?

Isn't that what Let's Encrypt is aiming for? Install a package, which configures a cronjob for you? https://letsencrypt.org/howitworks/ Which could just even become a default but optional dependency of your distro's web server package, or part of your Docker container, or whatever.

I tried to set up LE for my personal bunch of websites, but sadly the rate-limiting is still too strict for automation to be a viable option.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#70

Post by savanaly » Wed, Jan 27, 2016, 9:50 PM UTC

conanbatt wrote: post #36

drawkbox wrote: post #34

Hopefully costs for certificates will come down to encourage it as well. Services like letsencrypt can help.

Supply and demand would dictate otherwise

As another pointed out, the supply curve for these certs is probably close to horizontal so we should expect the equilibrium quantity to increase but not the price.