6 ms·

Google to prioritise secure websites

62 points by gbuckingham89 12y ago

rahimnathwani 12y ago
Previous discussion: https://news.ycombinator.com/item?id=8146433 https://news.ycombinator.com/item?id=8146433
diafygi 12y ago
Good. Also, I recently poked the bear on the chromium and mozilla dev security mailing lists, and they started discussing ways to push https in the browser UI. Hopefully this momentum continues! https://groups.google.com/a/chromium.org/forum/m/#!topic/security-dev/rGM2oiKZqZU https://groups.google.com/a/chromium.org/forum/m/#!topic/sec...
- michaelbuckbee 12y ago
  I really hope you are successful as I've been really frustrated with how the browser vendors are even indicating different levels of SSL certificates. Checkout how FF renders a standard domain validated cert on a site versus one with extended green bar validation: https://www.expeditedssl.com/assets/browser-ssl/thumbs/standard-validation-firefox-ssl-329f2da0d9923eff161b8a0065537f74.png https://www.expeditedssl.com/assets/browser-ssl/thumbs/stand... https://www.expeditedssl.com/assets/browser-ssl/thumbs/extended-validation-firefox-ssl-2493c3b7a57481a05f3cbf97cf68dc36.png https://www.expeditedssl.com/assets/browser-ssl/thumbs/exten... The gray icon might as well not be there as far as consumers are concerned and blue vs green crossing guard icons really fail to indicate anything of use to an end user. If you want to see a big list of SSL UI screenshots, I have them up at: https://www.expeditedssl.com/pages/visual-security-browser-ssl-icons-and-design.html https://www.expeditedssl.com/pages/visual-security-browser-s...
- dhimes 12y ago
  I disagree. It's not that I don't think that secure websites are preferable, but instead I see Google's growing influence being able to shape the web the way Google wants it to be, and them being perfectly willing to use that influence. You can argue that the things they are doing now are making the web better. But are we assured that this will always be the case? What happens if this influence turns completely and more directly self-serving? Such as, Google adwords customers are given higher organic ranking, weighted by how much they spend? At first glance it might appear that such a scheme would work against adwords, but it really wouldn't because the ad-click advertising just doesn't work for a lot of us, but organic search does. Absolute power corrupts absolutely, and all that.
  - diafygi 12y ago
    I would think in this instance that this is not just a Google opinion. It is now becoming a Best Practice[1]. [1] - http://tools.ietf.org/html/rfc7258 http://tools.ietf.org/html/rfc7258
    - dhimes 12y ago
      But shouldn't page rank be about content?
jgrahamc 12y ago
Related: https://news.ycombinator.com/item?id=8146660 https://news.ycombinator.com/item?id=8146660
- robert_tweed 12y ago
  [meta] Wow, that's a lot of duplicate articles about this reaching the front page, one of which already contains a complaint about the mods changing the title. They could really do with merging these articles together. I've previously suggested a feature to show title change histories under the title, before the comments, because certain comments make no sense after the title is changed. I'd also like to suggest a similar feature for merges whereby when there are separate articles talking about the same thing, the canonical one gets used as the main link and others submissions are retained, again, under the title, before the comments.
- robert_tweed 12y ago
  It's good to see CloudFlare are going to make this free. In planning the launch of my own new site/blog/thing (hopefully launching soon), the one thing that's really stopping me considering SSL isn't the cost of certificates (which can be had for peanuts anyway if you don't care too much which CA you use) it's the ongoing costs and increased server load. Right now, launching without CloudFlare would almost certainly result in the unfortunate death of my VPS. SSL would only expediate that. OTOH, the minimum paid CloudFlare package would quadruple my hosting costs - I'm not running enterprise scale infrastructure for my personal site! If CloudFlare do make it part of their free package, I will definitely use SSL by default.
  - jgrahamc 12y ago
    Yes, we are going to make SSL certificates available to customers on our free plan for free.
    - thejosh 12y ago
      You are? ETA?
borplk 12y ago
Great. SEO people will now rush in for their fancy certificates.
- thejosh 12y ago
  If cloudflare start offering free SSL certificates we'll start seeing so many with HTTPS if it actually gives a SERP boost.
rabino 12y ago
But they also prioritise speed right? So if you have the same site served both in HTTP and HTTPS, which one will win?
- higherpurpose 12y ago
  Probably the HTTPS one, since the difference in speed isn't that big between the two.
jbb555 12y ago
"The decision could encourage more sites to turn on encryption, which makes them less vulnerable to hacking". What? This is entirely wrong. It makes them more vulnerable to hacking. There is a whole lot more complex software and configuration to get right, and we know SSL doesn't have a great recent history of that.... Of course it help secure the communications which presumably is what they meant but it's 100% wrong with the statement the article actually says.
- deleted 12y ago
  [deleted]
- shawabawa3 12y ago
  If you consider stuff like sniffing cookies to steal sessions as hacking, which most people do, then it's true. In terms of compromising the server you're right
  - claudius 12y ago
    As somebody else pointed out recently in another thread, being able to steal session cookies can even help you attack the server directly, as authenticated users usually have more/different write access to databases and the like, making (e.g.) SQL injections easier. In this regard, even if you don’t consider it “hacking a website” if someone steals session cookies, HTTPS makes it more difficult to “hack websites” in the sense of “getting root access to the server”. How that compares to the increased attack surface of the HTTPS implementation is of course up for debate.
- Someone1234 12y ago
  That line caught me too. It makes YOU (the consumer) less vulnerable to "hacking" (MiTM), it actually doesn't make the website less vulnerable and as you quite correctly pointed out somewhat more (just due to increased attack surface). That's a large part of the reason HTTPS/SSL isn't more common: It doesn't benefit the website as much as it benefits their customers and there are both real and perceived costs in deploying HTTPS. So you have to put pressure on them (websites) to adopt secure defaults. Google are now helping hugely.
okasaki 12y ago
Uh. What if a site doesn't need https? Like if it has just static pages with public content?
- agwa 12y ago
  Even a public static site needs HTTPS, for authentication and integrity: https://news.ycombinator.com/item?id=8146670 https://news.ycombinator.com/item?id=8146670
- augustl 12y ago
  Indeed. My static blog hosted on Linode behind Apache has survived a HN frontpage entry three times now. If I have to use HTTPS, does that mean I need a beefy server with lots of entropy?
  - agwa 12y ago
    No. My HTTPS blog hosted on Linode's smallest plan has survived a HN front page without any trouble. It's a myth that HTTPS causes significant resource overhead. As for entropy, your server only needs a small amount of entropy to seed a CSPRNG, and the CSPRNG takes it from there.
  - stephen_g 12y ago
    Nope! Google, from 2010: "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead." https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h... Entropy is a different matter, but I believe pretty much all virtualisation platforms have ways to ensure the VMs have enough entropy sources - so it should be fine.
  - jgrahamc 12y ago
    See "Is TLS Fast Yet?": https://istlsfastyet.com/ https://istlsfastyet.com/
- jonknee 12y ago
  "Needing" HTTPS and supporting it are two different things.
fiatjaf 12y ago
> "For now it's only a very lightweight signal - affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content - while we give webmasters time to switch to HTTPS," Google's Zineb Ait Bahajji and Gary Illyes said in the blog post. Later, high-quality content will be carrying less weight than HTTPS. Who knows what comes next.

62 points by gbuckingham89 12y ago

Previous discussion: https://news.ycombinator.com/item?id=8146433 https://news.ycombinator.com/item?id=8146433

Good. Also, I recently poked the bear on the chromium and mozilla dev security mailing lists, and they started discussing ways to push https in the browser UI. Hopefully this momentum continues! https://groups.google.com/a/chromium.org/forum/m/#!topic/security-dev/rGM2oiKZqZU https://groups.google.com/a/chromium.org/forum/m/#!topic/sec...

michaelbuckbee 12y ago
I really hope you are successful as I've been really frustrated with how the browser vendors are even indicating different levels of SSL certificates. Checkout how FF renders a standard domain validated cert on a site versus one with extended green bar validation: https://www.expeditedssl.com/assets/browser-ssl/thumbs/standard-validation-firefox-ssl-329f2da0d9923eff161b8a0065537f74.png https://www.expeditedssl.com/assets/browser-ssl/thumbs/stand... https://www.expeditedssl.com/assets/browser-ssl/thumbs/extended-validation-firefox-ssl-2493c3b7a57481a05f3cbf97cf68dc36.png https://www.expeditedssl.com/assets/browser-ssl/thumbs/exten... The gray icon might as well not be there as far as consumers are concerned and blue vs green crossing guard icons really fail to indicate anything of use to an end user. If you want to see a big list of SSL UI screenshots, I have them up at: https://www.expeditedssl.com/pages/visual-security-browser-ssl-icons-and-design.html https://www.expeditedssl.com/pages/visual-security-browser-s...
dhimes 12y ago
I disagree. It's not that I don't think that secure websites are preferable, but instead I see Google's growing influence being able to shape the web the way Google wants it to be, and them being perfectly willing to use that influence. You can argue that the things they are doing now are making the web better. But are we assured that this will always be the case? What happens if this influence turns completely and more directly self-serving? Such as, Google adwords customers are given higher organic ranking, weighted by how much they spend? At first glance it might appear that such a scheme would work against adwords, but it really wouldn't because the ad-click advertising just doesn't work for a lot of us, but organic search does. Absolute power corrupts absolutely, and all that.
- diafygi 12y ago
  I would think in this instance that this is not just a Google opinion. It is now becoming a Best Practice[1]. [1] - http://tools.ietf.org/html/rfc7258 http://tools.ietf.org/html/rfc7258
  - dhimes 12y ago
    But shouldn't page rank be about content?

jgrahamc 12y ago

Related: https://news.ycombinator.com/item?id=8146660 https://news.ycombinator.com/item?id=8146660

robert_tweed 12y ago
[meta] Wow, that's a lot of duplicate articles about this reaching the front page, one of which already contains a complaint about the mods changing the title. They could really do with merging these articles together. I've previously suggested a feature to show title change histories under the title, before the comments, because certain comments make no sense after the title is changed. I'd also like to suggest a similar feature for merges whereby when there are separate articles talking about the same thing, the canonical one gets used as the main link and others submissions are retained, again, under the title, before the comments.
robert_tweed 12y ago
It's good to see CloudFlare are going to make this free. In planning the launch of my own new site/blog/thing (hopefully launching soon), the one thing that's really stopping me considering SSL isn't the cost of certificates (which can be had for peanuts anyway if you don't care too much which CA you use) it's the ongoing costs and increased server load. Right now, launching without CloudFlare would almost certainly result in the unfortunate death of my VPS. SSL would only expediate that. OTOH, the minimum paid CloudFlare package would quadruple my hosting costs - I'm not running enterprise scale infrastructure for my personal site! If CloudFlare do make it part of their free package, I will definitely use SSL by default.
- jgrahamc 12y ago
  Yes, we are going to make SSL certificates available to customers on our free plan for free.
  - thejosh 12y ago
    You are? ETA?

borplk 12y ago

Great. SEO people will now rush in for their fancy certificates.

thejosh 12y ago
If cloudflare start offering free SSL certificates we'll start seeing so many with HTTPS if it actually gives a SERP boost.

rabino 12y ago

But they also prioritise speed right? So if you have the same site served both in HTTP and HTTPS, which one will win?

higherpurpose 12y ago
Probably the HTTPS one, since the difference in speed isn't that big between the two.

jbb555 12y ago

"The decision could encourage more sites to turn on encryption, which makes them less vulnerable to hacking". What? This is entirely wrong. It makes them more vulnerable to hacking. There is a whole lot more complex software and configuration to get right, and we know SSL doesn't have a great recent history of that.... Of course it help secure the communications which presumably is what they meant but it's 100% wrong with the statement the article actually says.

deleted 12y ago
[deleted]
shawabawa3 12y ago
If you consider stuff like sniffing cookies to steal sessions as hacking, which most people do, then it's true. In terms of compromising the server you're right
- claudius 12y ago
  As somebody else pointed out recently in another thread, being able to steal session cookies can even help you attack the server directly, as authenticated users usually have more/different write access to databases and the like, making (e.g.) SQL injections easier. In this regard, even if you don’t consider it “hacking a website” if someone steals session cookies, HTTPS makes it more difficult to “hack websites” in the sense of “getting root access to the server”. How that compares to the increased attack surface of the HTTPS implementation is of course up for debate.
Someone1234 12y ago
That line caught me too. It makes YOU (the consumer) less vulnerable to "hacking" (MiTM), it actually doesn't make the website less vulnerable and as you quite correctly pointed out somewhat more (just due to increased attack surface). That's a large part of the reason HTTPS/SSL isn't more common: It doesn't benefit the website as much as it benefits their customers and there are both real and perceived costs in deploying HTTPS. So you have to put pressure on them (websites) to adopt secure defaults. Google are now helping hugely.

okasaki 12y ago

Uh. What if a site doesn't need https? Like if it has just static pages with public content?

agwa 12y ago
Even a public static site needs HTTPS, for authentication and integrity: https://news.ycombinator.com/item?id=8146670 https://news.ycombinator.com/item?id=8146670
augustl 12y ago
Indeed. My static blog hosted on Linode behind Apache has survived a HN frontpage entry three times now. If I have to use HTTPS, does that mean I need a beefy server with lots of entropy?
- agwa 12y ago
  No. My HTTPS blog hosted on Linode's smallest plan has survived a HN front page without any trouble. It's a myth that HTTPS causes significant resource overhead. As for entropy, your server only needs a small amount of entropy to seed a CSPRNG, and the CSPRNG takes it from there.
- stephen_g 12y ago
  Nope! Google, from 2010: "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead." https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h... Entropy is a different matter, but I believe pretty much all virtualisation platforms have ways to ensure the VMs have enough entropy sources - so it should be fine.
- jgrahamc 12y ago
  See "Is TLS Fast Yet?": https://istlsfastyet.com/ https://istlsfastyet.com/
jonknee 12y ago
"Needing" HTTPS and supporting it are two different things.

fiatjaf 12y ago

> "For now it's only a very lightweight signal - affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content - while we give webmasters time to switch to HTTPS," Google's Zineb Ait Bahajji and Gary Illyes said in the blog post. Later, high-quality content will be carrying less weight than HTTPS. Who knows what comes next.