HTTPS as a ranking signal

Re:HTTPS as a ranking signal by Oculus on Thursday August 07, 2014 @02:57AM (#8146549)

I'm not sure I agree with this. I don't see a point in HTTPS for 100% static sites.

[ Parent | on HN ]

Re:HTTPS as a ranking signal by dsl on Thursday August 07, 2014 @03:15AM (#8146593)

The NSA and other state actors can use non-secure pages to inject code to exploit the browser and compromise your visitors.

http://en.wikipedia.org/wiki/FOXACID#QUANTUM_attacks

[ Parent | on HN ]

Re:HTTPS as a ranking signal by icebraining on Thursday August 07, 2014 @03:50AM (#8146668)

State actors are probably irrelevant in this discussion; few of them won't be able to get a certificate to any website they want, in my opinion.

[ Parent | on HN ]

Re:HTTPS as a ranking signal by dsl on Thursday August 07, 2014 @04:03AM (#8146709)

This is a known issue and being addressed as well.

http://tools.ietf.org/html/draft-ietf-websec-key-pinning-11

http://dev.chromium.org/sts

[ Parent | on HN ]

Re:HTTPS as a ranking signal by etherealG on Thursday August 07, 2014 @03:03AM (#8146570)

That 100% static site can be monitored. Which pages you visit on it and what that says about you.

Privacy is always valuable.

[ Parent | on HN ]

Re:HTTPS as a ranking signal by joesavage on Thursday August 07, 2014 @03:14AM (#8146590)

I'm not sure about "always".

I run a site that provides counter information for League of Legends (http://www.championcounter.com/) and I doubt very much my users will benefit at all from me moving over to HTTPS.

[ Parent | on HN ]

Re:HTTPS as a ranking signal by asperous on Thursday August 07, 2014 @03:22AM (#8146611)

A lot of work routers might flag that site url as "GAMING" and with too much use could potentially contribute to someone losing their job.

Also some isps have been caught injecting ads into plain text web sites [1]. Do you want more ads on your site that you didn't put there?

[1] http://zmhenkel.blogspot.com/2013/03/isp-advertisement-injec...

[ Parent | on HN ]

Re:HTTPS as a ranking signal by joesavage on Thursday August 07, 2014 @03:41AM (#8146653)

Switching over to HTTPS in and of itself shouldn't stop much data leakage given that the hostname - at least at current - isn't difficult to obtain (and really gives the game away for the content you're visiting as far as my site is concerned), but I suppose it's a step in the right direction and will stop primitive tracking attempts.

Protecting against code injection is actually a fair point though.

[ Parent | on HN ]

Re:HTTPS as a ranking signal by spacefight on Thursday August 07, 2014 @03:20AM (#8146608)

Sure they would benefit. They could check whatever is on your site without anyone in between noticing (WLAN e.g. at starbucks, corporate LANs and the proxies used etc etc). There are companies out there, who buy surf-habits (read: browsing logs of URLs visited) and mine it for valuable data.

Encrypt.

[ Parent | on HN ]

Re:HTTPS as a ranking signal by rakoo on Thursday August 07, 2014 @05:58AM (#8146917)

You're seeing HTTPS as a move from HTTP with a burden.

Let's see it the other way: any sane webserver allows you to easily activate TLS, and generating a certificate is both free and easy. What's the point of going back to HTTP at this point ?

[ Parent | on HN ]

Re:HTTPS as a ranking signal by ayrx on Thursday August 07, 2014 @03:01AM (#8146565)

Static sites can have their content modified silently in a MITM attack as well.

[ Parent | on HN ]