Google Rolls Out Encrypted Web Search Option 176
Posted
by
CmdrTaco
from the step-in-the-right-direction dept.
from the step-in-the-right-direction dept.
KirinMercury writes "Google began offering an encrypted option for Web searchers on Friday and said it planned to roll it out for all of its services eventually. People who want to use the more secure search option can type 'https://www.google.com' into their browser, scrambling the connection so the words and phrases they search on, and the results that Google displays, will be protected from interception." Note that you need the 'www' for it to work. Dropping it redirects you to a non-ssl page. You might have read this on Saturday, but if you missed it, it's still worth knowing.
Re:This will have interesting results for webmaste (Score:1, Insightful)
Google will know which sites it returned to a given search user. If the sites that are selected by the user are using Google Analytics, then Google will also know which sites the user's clicked on. Perhaps they will make this information available to site owners via Analytics?
Re:This will have interesting results for webmaste (Score:5, Insightful)
now we need encrypted /. (Score:5, Insightful)
Encrypted should be the default for every web site IMNSHO.
Re:Don't Be Evil (Score:4, Insightful)
Re:MitM only? (Score:3, Insightful)
It's a bit of a stretch to say Google is "intercepting" the traffic since they are in fact the intended recipient.
Easier Solution (Score:4, Insightful)
Re:This should be the default, not a special thing (Score:1, Insightful)
Turning it on by default breaks sites which use referer (WSJ, experts-exchange, are two which come to mind). You might (legitimately) argue that such sites deserve it for being evil, but launching breaking features in an on-by-default state is bad, especially when it's done by a company with as many users as Google.
Also, I suspect they wanted to see what the effect of lots of SSL usage for their search product would be before turning it on and watching their web site fall down on its knees.
Re:MitM only? (Score:5, Insightful)
Yes, but they need to subpoena them, which is a lot more work than automated monitoring.
More to the point, though, I said the more of the web goes SSL, my point being that something like the great firewall of China would be much harder to implement if most sites are on secure connections, thus only endpoints are known. Dissident news pages could be replicated across 'legitimate' domains, for example. Without live packet inspection it becomes much harder to decide who to block.
With Google providing security even for relatively non-sensitive data, there is hope of others following suit.
Re:This will have interesting results for webmaste (Score:3, Insightful)
Re:This will have interesting results for webmaste (Score:3, Insightful)
Good. That's the point.
You want to know about the people who visit your site? Ask them to sign a visitor's book. Just because having background information on web visitors makes companies' lives easier doesn't mean that people don't have the right to surf anonymously.
Re:So much for "do no evil" (Score:3, Insightful)
A centralized search provider cannot help but have complete information about searches coming from a given IP. Even if we use a P2P search, the peers we end up using can profile us. To increase privacy, one could generate more searches. It is trivial to write a shell script to wget a bogus google search every minute or so, pick a few words at random out of the result and use them for the next request.
Re:This will have interesting results for webmaste (Score:4, Insightful)
It's 1996?
Re:now we need encrypted /. (Score:3, Insightful)
It's similar to the theory that people surfing [legit] porn through tor are doing the people who actually need the anonymity a favour: if the only things that are encrypted are things that are sensitive, then it becomes easier to target interesting sites. If everything is encrypted, then you have to decrypt everything in order to find out what bits are interesting. And that's a much harder nut to crack.