Google Rolls Out Encrypted Web Search Option 176
KirinMercury writes "Google began offering an encrypted option for Web searchers on Friday and said it planned to roll it out for all of its services eventually. People who want to use the more secure search option can type 'https://www.google.com' into their browser, scrambling the connection so the words and phrases they search on, and the results that Google displays, will be protected from interception." Note that you need the 'www' for it to work. Dropping it redirects you to a non-ssl page. You might have read this on Saturday, but if you missed it, it's still worth knowing.
Change it in the Firefox search box: (Score:5, Informative)
In ~/.mozilla/firefox/(profile id).default/search.json, find this:
{"template":"http://www.google.com/search","rels":[],"params":[{"name":"q","value":"{searchTerms}"}
Change it to this:
{"template":"https://www.google.com/search","rels":[],"params":[{"name":"q","value":"{searchTerms}"}
Restart browser
Re: (Score:2)
For me, the URL when searching goes to https://www.google.com/ [google.com] after that edit, however google then redirect me to http://www.google.co.uk./ [google.co.uk] :(
Re: (Score:2)
For me, the URL when searching goes to https://www.google.com/ [google.com] after that edit, however google then redirect me to http://www.google.co.uk/ [google.co.uk] :(
Try using the page for advanced search instead https://www.google.com/advanced_search [google.com]. That does not get redirected for me (www.google.com gets redirected to www.google.fi automatically, which I do not want).
Comment removed (Score:5, Informative)
Mod Parent up! Easier method (Score:2)
Re: (Score:2, Funny)
Hey, if you find opening and using a GUI easier than opening and editting a config file, you're in with the wrong crowd.
Re:Mod Parent up! Easier method (Score:5, Funny)
What real people see in these instructions:
1. Go to address bar.
2. Type about:config.
3. Type "keyword.URL" in the search bar.
4. Double-click.
5. Edit result.
6. Click OK.
What apparently "real" geeks see in these instructions:
1. Pry your hands away from keyboard. Use chisel to remove Cheeto dust encrusting fingers there if need be.
2. Locate mouse.
3. Mutter profanities to poster for suggesting this primitive means of interface (this step is important, as later steps depend on it).
4. Increase volume of profanities as you are forced to wrench your eyes away from the relaxing phosphor glow of monitor to locate mouse.
5. Increase volume of profanities as you wait for eyes to adjust to the otherwise pitch-black room to locate mouse.
6. Increase volume of profanities as you look for the mouse cable coming out of the computer to find mouse.
7. Increase volume of profanities as you remember you have a wireless mouse.
8. Go back to keyboard and type up scathing dissertation against the clearly inferior intelligence that suggested this.
9. Realize you have now returned to step 1. Repeat from there, remembering to skip over step 8 this time.
10. Give up on finding mouse and, grumbling, go to Fry's Electronics to find a new mouse (NOTE: if there is no Fry's nearby, you are clearly not a "real" geek, and most likely do not even exist, as the modern world ceases to exist outside the range of Fry's).
11. Return home. Allow eyes to readjust to pitch blackness after being out in the big blue-ceiling room.
12. Install new mouse.
13. Reinstall new mouse.
14. Update operating system. Mouse might work this time. Whoever heard of this new technology, anyway? "USB"? Why couldn't you find any serial port mice? Those are way more l33t.
15. Train hand-eye coordination enough to use mouse. Try not to reflexively touch keyboard, else you will be back at step 1.
16. Go to address bar.
17. Increase volume of profanities.
18. Stubbornly type "about:config".
19. Stare at new interface.
20. Back to Fry's to find a book on how modern interfaces work. You never had to deal with all this confusing nonsense with a keyboard, dadgummit!
21. Type "keyword.URL" into search bar.
22. Realize you are just bashing your precious keyboard at this point due to soaring blood pressure due to anger at having to use a mouse.
23. Wait a few hours to calm down. Don't touch keyboard in that time.
24. Type "keyword.URL" into search bar.
25. Double-click.
26. Edit result.
27. Click OK.
28. Make muttering comments to yourself, passively-aggressively asking if the person who suggested this is happy now.
29. Go to IRC and detail this harrowing experience to your l33t friends.
See? That's WAY more steps than locating and editing a config file!
Re: (Score:3, Informative)
Re: (Score:2, Informative)
Mozilla's SeaMonkey v2 support? (Score:2)
Hmm, I tried in my SeaMonkey (SM) v2.0.4 but it didn't work. I changed all Google to have https part an restarted SM. What else did I miss?
Easier Solution (Score:4, Insightful)
Re: (Score:2)
1. Install Stylish [mozilla.org]
2. Install the Google Left Navigation Panel Popup [userstyles.org] style
3. ???
4. Profit!
For Google Chrome (Score:3, Informative)
Basics Tab -> Manage button for default search
Add Button ->
Name: SSLGoogle (or whatever you want)
Keyword: sslGoogle (or whatever you want)
Url: https://www.google.com/search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q=%s
Simple Chrome and Firefox howtos: (Score:4, Informative)
instructions for chrome & firefox:
firefox [simplehelp.net]
chrome [coolgeex.com]
Re: (Score:2)
Warning: not tested.
Maybe writing a simple greasemonkey script?
This will have interesting results for webmasters (Score:5, Interesting)
Re:This will have interesting results for webmaste (Score:5, Informative)
Re: (Score:3, Informative)
It doesn't work for images after trying a few different ways, ie: changing the address to https after an image search, or doing a true https search, to which you don't have the option of choose "images" as a search type. You *can* search videos, news and blogs with SSL but not images at this time. Wonder why?
Re: (Score:2)
Because then schoolchildren could imagesearch porn without being blocked by filters?
Re: (Score:2)
I would imagine that it's because when you click on an image after doing an image search, it shows you the image in a top frame with actual result page in a bottom frame. Most web browsers will whine about showing mixed content like that (since the top frame will still be secure, but the bottom frame won't), and Google probably hasn't had the time to rejigger the way image search works yet.
Re: (Score:2)
They could still make the first page ssl, the one without the frames, which is directly on the www.google.com domain, not a sub-domain. They do the same with news, the results themselves are ssl, but the links on that page are not. There is no technical limitations to doing this, it appears they just haven't gotten around it ot.
Re: (Score:3, Insightful)
Good. That's the point.
You want to know about the people who visit your site? Ask them to sign a visitor's book. Just because having background information on web visitors makes companies' lives easier doesn't mean that people don't have the right to surf anonymously.
Re:This will have interesting results for webmaste (Score:4, Insightful)
It's 1996?
Re: (Score:2)
Re:This will have interesting results for webmaste (Score:5, Interesting)
You should look at the page source of a results page sometime. Right now the targets are to https://www.google.com/ [google.com] with the rest of the URL encoded to tell google where to redirect you to. The HTTP/1.1 200 OK reply sets a cookie and then the HTML has a JS and meta refresh to send yo on your way to where you expect to go to. To get the referer to indicate it was from google, all they need to do for most browsers is have the targets still be to http://www.google.com/ [google.com] instead if the real target is http instead of https. All this incidentally seems kind of pointless to me BTW, since now other parties cannot see your google searches, but they can still see the sites that you do visit from the results.
Re: (Score:2)
You could disable send referrer (network.http.sendRefererHeader). I use PrefBar [mozdev.org] extension in Mozilla's SeaMonkey v2.0.4. However, some Web sites hate the no send referrers. :(
Re:This will have interesting results for webmaste (Score:5, Insightful)
Re: (Score:3, Interesting)
The client creates the referrer header... it's a privacy invasion in the same way that it would be a privacy invasion to tell you that I have a spoon fetish then complain because you heard me tell you.
Of course, how you process that information can and will be regulated, and it is possible to store/use the information in a way that will violate my privacy. But it's not your fault that you heard it, and I can't blame you if you don't forget it providing you don't choose to write it down.
Re: (Score:3, Insightful)
Re: (Score:2)
That's bogus. How many people know that their "client" is sending information about them to the sites they visit? How many people know what a "referrer header" even is?
You use the metaphor that information sent via a referrer header is like a conversation overheard. If that's the case, then I have the right to whisper when I talk so you can't "overhear" me.
Re: (Score:2)
What I was trying to get at is that "the concept of" the referrer header is not a privacy violation... you are on tenuous thought crime ground if you target the ability to perceive information. A privacy violation occurs only when you store or distribute information in some inappropriate manner.
Consider it an extension of the traditional (and sadly superseded) US principle of wireless that you're allowed to hear any information which appears on the airwaves but you're not necessarily allowed to act freely u
Re: (Score:2)
The principle is outdated in the same way that the Constitution is outdated: if you don't understand your country, you are condemned to reinvent it poorly.
Everything you said about tracking and people's surprise may be true, but it's nothing in the technology itself which is inherently a violation of privacy: the violation is in the particular processing and storage of data consciously (or occasionally recklessly) performed by various corporations.
You can, if you want, pretend that a social problem is techn
MitM only? (Score:4, Interesting)
What this means, I believe, is that your web browsing might be immune to man-in-the-middle interception.
Interception by Google (and thus by anyone with the power to compel Google, IE USA, China, etc) will be the same as before. As well, you're still connecting TO Google, so you're still likely to be blocked from the site by the Great Firewall arrangements, even if your search terms themselves might be encrypted.
And not to forget that China has a tame certificate authority...
Re: (Score:2)
Not to mention that it's pretty clear the three letter agencies have gotten CA cert signed by verisign or some other company.
Re: (Score:3, Insightful)
It's a bit of a stretch to say Google is "intercepting" the traffic since they are in fact the intended recipient.
Re:MitM only? (Score:4, Funny)
That's adorable
Re: (Score:2)
Comment removed (Score:5, Insightful)
Re: (Score:2)
Interception by Google will be the same as before.
My mom called me last night, and I 'intercepted' everything she said.
I do not think interception means what you think it means...
Re: (Score:2)
Talking of new services ... (Score:5, Funny)
Slashdot began offering an dupe-free option for Web searchers on Friday (and then repeated the offer on Saturday) ... *facepalm*
How about we just rename the site to Reddit ... I mean, every other story, we already reddit.
Re: (Score:2)
Don't whine.
Re: (Score:2)
Re: (Score:2)
Why wait until Friday ???
Come on, the excuse was great "in case you missed the useful information the first time". Come to think of that, this excuses all dupes, since they all have some use. I publicly apologize for all the times I've criticized dupes. They really did have a good purpose. I eagerly await a dupe of this dupe on Friday.
but not the custom home page (Score:2)
presumably G will fix this soon? hello Google?
Re: (Score:2)
I don't believe the personal page is encrypted yet.
I just tried to load up https://www.google.com/ig [google.com] and it re-directed me to http://www.gooogle.com/ig [gooogle.com]
Re: (Score:2)
However, Google Voice *only* does SSL, so you *can't* use that gadget. Not sure why they even offer it - though it used to work when I first added it, though https://www.google.com/ig [google.com] worked then too.
That, and the fact that the gmail gadget seems to flip flop on whether or not it can use SSL on a weekly basis.
You'd think Google could figure these things out.
Change in Chrome (Score:2)
12/14/2010 log #3342 (Score:5, Funny)
session id #4ddr-tg62-hh89
12:30 https initiated begin session
12:31 "divorce lawyer"
12:34 "divorce lawyer low cost"
12:34 "hitman hire"
12:36 "hitman low cost"
12:37 "assassination do-it-yourself"
12:40 "polonium-210 availability"
12:41 "legal anthrax"
12:41 "ricin suppliers"
12:42 "arsenic wholesale"
12:43 "legal mustard gas"
12:43 "cheap readily available poisons"
12:46 "antifreeze toxicity"
12:49 "brainstorming murder scenarios"
12:52 "how to run hose from exhaust to passenger compartment"
12:55 "wits end"
12:41 "chloroform wholesalers"
12:45 "shovel hacksaw garbage bags"
12:45 interrupt: preemptive googlebot legal log crawler has identified a high criminal behavior correlation index in session id #4ddr-tg62-hh89. log and ip address forwarded to google-inbox@fbi.gov
1:05 "stalling law enforcement"
1:06 "good indoor hiding places"
1:06 "proper handgun usage"
1:26 session timed out
Re: (Score:2)
Re: (Score:2)
Here you go. [youtube.com] I did have to cut it down to seven steps, and I reordered it slightly, but I think the overall idea is still very intact, if a little rushed.
SSL Wikipedia & TPB (Score:5, Informative)
English Wikipedia: https://secure.wikimedia.org/wikipedia/en/wiki/Main_Page [wikimedia.org]
The Pirate Bay: https://thepiratebay.org/ [thepiratebay.org]
Still waiting on Slashdot to join the 21st century.
Re: (Score:2)
So does Facebok, Twitter, Apple.com and Microsoft.com. Just the firsth four I thought I'd try.
Come one /., please support SSL!
Re: (Score:2)
Re: (Score:2, Interesting)
/. has supported SSL for a long time. I think it may have been a plumb for subscribers when I first subscribed, but it doesn't seem to be listed on the FAQ so maybe not.
Here's your comment: https://tech.slashdot.org/comments.pl?sid=1664284&cid=32337858 [slashdot.org]
To Use as Default Search (Score:2)
H
Re: (Score:2)
now we need encrypted /. (Score:5, Insightful)
Encrypted should be the default for every web site IMNSHO.
Re: (Score:3, Interesting)
I agree, but that would require the death of IE6 (and XP), or IPv4. SSL is incompatible with name based virtual hosting unless you add in SNI, which isn't supported by IE6 (or any browser that runs on XP, for that matter).
Don't get me wrong, I agree entirely and IE6 and IPv4 should be nothing more than a bad memory by this point, but they're not.
Re: (Score:2)
To put it bluntly, what for?
HTTPS only conceals the content of your web browsing, not which sites you visit. Except for user authentication, and possibly user-to-user messages, adding HTTPS to Slashdot and most other public content sites would be utterly pointless since anyone who sees that your computer is talking to a Slashdot IP has immediate access to all of the content you're viewing.
Sensitive communications (email, IM, etc) should be encrypted. But anything that's public, nah. If you really want compl
Re: (Score:3, Insightful)
It's similar to the theory that people surfing [legit] porn through tor are doing the people who actually need the anonymity a favour: if the only things that are encrypted are things that are sensitive, then it becomes easier to target interesting sites. If everything is encrypted, then you have to decrypt everything in order to find out what bits are interesting. And that's a much harder nut to crack.
Default (Score:5, Funny)
Wake me up when they enable a default option like in Gmail.
This should be the default, not a special thing (Score:2)
I fail to see (Score:2, Interesting)
Re:I fail to see (Score:5, Informative)
No, that's not how https works. All a network administrator will see is what host was connected to. After the secure socket is opened, only then is the command sent out over the encrypted stream to "GET someresource".
Re:I fail to see (Score:4, Funny)
otherwise the admin would easily see https://login.yourbank.com/?login=you&password=hunter2 [yourbank.com]
Re:I fail to see (Score:4, Informative)
All I saw was https://login.yourbank.com/?login=********&password=******** [yourbank.com]
View from a user (Score:2)
Hi.
Thank you for posting this, I forgot how to log into my bank on Netscape. But it doesn't work. I tried your link to my bank account, and got some weird thing on my screen instead. I even rebooted and defragged and it still doesn't work.
How do I log into my bank on Netscape?
Re: (Score:2)
And does not said GET request include the URL parameters, including q=some+search+query?
Re: (Score:2)
Oh, sorry, I misread and thought you said that the connected host and the GET request were all that was seen. I didn't think that made sense...
Searches are still open to side channel attacks (Score:2, Interesting)
iGoogle w/SSL? (Score:2)
It'd be nice if they could also enable SSL for those of us who use the Google Personalized page (aka iGoogle) at http://www.google.com/ig [google.com]
the question is (Score:2)
Re: (Score:2)
Re: (Score:2)
Making it the default (Score:2)
DevilsWorkShop.org has some succinct instructions on how to set this as the default search type in the "Big Three" browsers of IE, FF, and Chrome.
http://devilsworkshop.org/how-to-use-google-ssl-search-as-default-search-engine-in-chrome-firefox-and-internet-explorer/ [devilsworkshop.org]
I have no affiliation with them.
Incognito? (Score:3, Interesting)
A logical next step would be to set https as the default when in Incognito mode in Chrome, or Private Browsing in Firefox.
Not just www required (Score:3, Informative)
It also only works for google.com - or at least, going to https://www.google.co.uk/ [google.co.uk] redirects you to http://www.google.co.uk./ [google.co.uk]
Re: (Score:3, Informative)
Re: (Score:3, Informative)
But at least your ISP won't.
Re: (Score:3, Insightful)
A centralized search provider cannot help but have complete information about searches coming from a given IP. Even if we use a P2P search, the peers we end up using can profile us. To increase privacy, one could generate more searches. It is trivial to write a shell script to wget a bogus google search every minute or so, pick a few words at random out of the result and use them for the next request.
Re:Now we just need Google itself to stop retainin (Score:5, Informative)
And turning off Javascript will help you how?
The links themselves are google links, regardless of whether JS is on or off, your click goes to something like:
http://www.google.com/url?sa=t&source=web&ct=res&cd=3&ved=0CBoQFjAC&url=http%3A%2F%2Fblah.blah.com%2Fbyu%2Findex.php%3Fp%3D15365%26more%3D1%26c%3D1%26tb%3D1%26pb%3D1&ei=2fn7S4mMEsGBlAem2fTBDw&usg=AFQjCNHWjfNi_UtFFF-vpxP0qcH9eQKvzg&sig2=pjkVdJt9EijRDfi3g7eMsA [google.com]
And Google captures the bits they want then sends you to the page they showed you in the first place.
Retype the URL from orbit, it's the only way to be sure.
Re: (Score:2)
Re: (Score:2)
I think it is generally considered acceptable to keep agregate statistics (ie. 125,435 people clicked on this link) but not so good to keep individual statistics (ip ___.___.___.___ clicked on this link, then that one, then this other one)
And keeping the former does not require keeping the later. The first example lets you improve your searches based on how many people like different links, the second one lets you track how a specific person uses the internet. one of these things I object to, the other one
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Maybe. If you have administrative control of your desktop.
Otherwise, securing the connection between your desktop and Google won't prevent the employer from finding out everything you do using the computer that they control.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Absolutely! Let's make it a fair playing field!
I'm more concerned that this is even being touted as something important. You are giving away information every time you search. You are not securing your privacy by searching encrypted, you are just giving Google an edge.
Seriously, how many people do you think are doing man in the middle attacks to find what you are searching for on Google? This is nothing important or major that you are searching encrypted vs. unencrypted.
Re: (Score:2)
Seriously, how many people do you think are doing man in the middle attacks to find what you are searching for on Google? This is nothing important or major that you are searching encrypted vs. unencrypted.
Not necessarily "attacks" but a lot of parties could be interested:
- ISP(s) tracking and storing data
- hotspot provider tracking, storing, reselling data
- dictatorship tracking "suspicious" searches by citizens and foreigners
- employer tracking
Just because you are giving the data to Google, doesn't mean you need to give it to everybody else as well. It can be important.
Re:Was this posted before? (Score:5, Interesting)
I'm actually intrigued by this concept of Slashdot purposefully (assumption: text in current summary implies they did this on purpose) re-posting news to make sure we see it, a form of public-service-announcement. Yes, Slashdot is a news service, but I don't generally see timestamp-based news-services prioritizing/reposting content like this. The main news sources just keep covering the same story over and over again, as if it were evolving by the minute, but that's about it. Interesting.
Re: (Score:2)
Kinda strange, I check /. maybe only slightly less during the weekend as during the week, but somehow I completely missed the original post so I liked the dupe here.
Re: (Score:2)
Just another free service that Slashdot provides in order to add value.
I can't tell if you're complaining or not, but I'm grateful that they'll post a story like this a second time.
Re: (Score:2)
I can't tell if you're complaining or not
FWIW, I'm not complaining. I would have missed it too.
Another option would have been to purposefully delay the news until monday; they already shift stories around to deal with slow news days, and I wouldn't be surprised if they try to put the most engaging stories on the front page during the 10-3 hours (work around US timezones), or whenever their readership is already highest. Considering the running jokes about slashdot just reposting digg a few days later, it's
Re: (Score:2)
Re:Don't Be Evil (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Yes, this would immediately be much more useful if they included other server sets like www.google.co.th so those people being put into prison for what they are searching for may get a few more months of freedom.