Hacker News Reader

Comment by aembleton | Hacker News Reader

How does it get rid of competing ad networks? Does Google have a monopoly on serving ads over HTTPS?

It means your internet provider can't inject ads or profile you based on the content of the sites that you visit. Comcast, AT&T, and Verizon have all done similar: https://certsimple.com/blog/ssl-why-do-i-need-it#4-not-havin...

Sure they can. Your ISP can easily MitM you.

Not without throwing cert errors on every site I visit.

The only way they can MITM me is if they compromise my PC as well and install their root CA.

... or rather get an intermediate certificate from one of the umpteen root CAs your operating system embeds by default.

Is VeriSign going to refuse a certificate to AT&T?

Verisign will happily issue a certificate to AT&T for a domain that AT&T controls.

Verisign will not issue a certificate to AT&T for google.com--no matter how nicely AT&T asks.

Yes, and furthermore there's a very good reason to believe that this claim is true: as soon as they do, every copy of Chrome behind AT&T's network will go and snitch to Google, who will promptly investigate and get Verisign in deep trouble.

Here's what happened when Symantec issued fake Google certificates last year:

https://googleonlinesecurity.blogspot.com/2015/09/improved-d...

https://googleonlinesecurity.blogspot.com/2015/10/sustaining...

"Therefore we are firstly going to require that as of June 1st, 2016, all certificates issued by Symantec itself will be required to support Certificate Transparency. After this date, certificates newly issued by Symantec that do not conform to the Chromium Certificate Transparency policy may result in [annoying certificate warnings, just like self-signed certs]."

And that was just the work of a couple of employees who were inappropriately testing their issuance system and weren't even intending to attack anything. They got fired, which I expect is also a big part of why Google's response was so light.

http://www.symantec.com/connect/blogs/tough-day-leaders

>Is VeriSign going to refuse a certificate to AT&T?

I certainly hope so.

Ah. True, my mistake.

To connect to the internet you must install comcast internet-enhancing-certificate. It's the only way to make all websites secure by default™

No reason to compromise when you can force the user.

For one IIRC it kills referer headers and so search engines/ad networks can't build out a graph of where a user was prior. Google OTOH sends the majority of the traffic and it's reach in ads allows it fill in the gaps better than any other network.

HTTPS does not kill referrer or referer headers. See https://referer.rustybrick.com/

..so why are all of the search terms suddenly gone from google searche referer headers? Which happened at the same time google defaulted to https?

At that time they started using horribly annoying redirects.

They stopped linking search results directly to the webpages. You have no Google search referrer headers in your logs/analytics any more.

When the SERP loads, all the results link to the real webpages, so that you see their address in the browser status bar when hovering over a link. Clicking any result link triggers a script that replaces the URL with https://google.com/url?url=the_real_webpage_url.

When you click through, you're clicking a link from google.com to another link on google.com, which redirects to the webpage you intended to visit. The referrer the webpage sees is the intermediate google.com/url page, instead of the search result page. This prevents websites from getting search term data from the SERP URL, if it was present, by removing that URL from referrer headers entirely.

Did you read the page I linked to? My referer was https://encrypted.google.com/search?hl=en&q=What%20Is%20My%2...

Uh, the referrer is the page you came from. So if he opened the page on HN, then he wouldn't get the Google referrer, he'd get a page off HN.

If you read the page I linked to, it instructs you to search to try it out for yourself to see that search results are not stripped from the referrer.

> ..so why are all of the search terms suddenly gone from google searche referer headers? Which happened at the same time google defaulted to https?

Not related to HTTPS at all. This happened completely independently. It happened because Google went from having search URLs like this

    https://google.com/?q=term

    https://google.com/#q=term

And the things after the anchor-mark is never in your referer. Effectively this means that the only tool on the planet who knows what people searched for before entering your site is... Google Analytics.

As a website owner you're basically being co-erced into letting Google snoop on your users, at least if you want to know how they entered your site. And the fact of the matter that is most (all?) companies are willing to make that trade-off.

All in all pretty sad and very creepy.

Reply on news.ycombinator.com