Search more securely with encrypted Google web search | Hacker News Reader

Search more securely with encrypted Google web search

googleblog.blogspot.com

28 pointsyanw28 comments

On the Mac, I edited /Applications/Firefox.app/Contents/MacOS/searchplugins/google.xml, changing http to https where appropriate. Now the builtin Google search plugin uses SSL system-wide (and so does the autocomplete, AKA suggest queries feature, if you edit that link, as well). Hopefully, Firefox will make this the default.

When I go to https://www.google.com/ it redirects me to http://www.google.com. That's some amazing security right there! :P

Probably the encrypted version hasn't been deployed yet to the datacenter you're hitting.

You're probably right, but why post a blog about it announcing it to the world as if it is available before everything is synced up and ready? It makes Google look sloppy, IMO.

You'd be surprised at how often they do that. It happens with virtually every announcement.

I guess either you announce it after everyone's already seen it anyway or you announce it before it's released everywhere.

They say that they "Are Rolling out" not that it's "Immediately available", it takes a while for it to go live on a million+ servers.

The cache also works over https now:

https://webcache.googleusercontent.com/search?q=cache:XhZJrK...

But the "cached version" links on the secure search results still point you to http for some reason.

https://ssl.scroogle.org

Also https://duckduckgo.com

hello, I'm a blackberry user. I do like the site.... When I'm using a computer. However there's placement errors on the BB scripting side.

Highlighting over the buttons puts the button text over the link (search, I'm feeling ducky, etc.). If I knew of a way to send a screenshot, I would. If you need basic sanity checking so DDG looks pretty on the BB, email me at jwcrawley at gmail daught com

Thx. This doesn't look very easy, but for reference :)

http://www.bbgeeks.com/blackberry-guides/taking-screenshots-...

Next time I'm with someone with a blackberry, I'll take a look.

You could try using a blackberry simulator: http://na.blackberry.com/eng/developers/resources/simulators...

More details here:

http://www.google.com/support/websearch/bin/answer.py?answer...

It's a good idea, but I question how useful it really is. So, my search results page for "naughty things" is encrypted, but all the links on it aren't.

If you want to protect more than your searches from someone listening in, you'll have to get an encrypted VPN.

If you want to add it to your chrome URL bar:

https://www.google.com/search?q=%s

Great. I don't think it's going to change anything in my life (though you never know), but I really like it just on principle.

This is like Facebook saying store your data more securely by only posting it on their site.

This is like stopping your ISP from sniffing your search queries and reselling them.

Except that data's still available on all sites you land on, to all the 3rd party analytics platforms people use, all the ad networks people use, and to everything you pass through on your way to a destination.

As the duckduckgo guy puts it: "When you search on Google, not only is your info stored, but also when you click on a link, your search terms are passed on to that site via the Referer header. A lot of sites use this information to tailor content and advertising to you specifically. Your searches also show up in analytics tools, which people use for SEO and other tracking purposes. This information leakage creates legitimate privacy concerns."

And what's to stop ISPs logging the plain text https urls you access anyway?

HTTPS doesn't send referrers to the sites you visit, so no one will ever see your query string, or even know you were coming from Google.

"And what's to stop ISPs logging the plain text https urls you access anyway?"

URLs aren't sent in plain text over HTTPS.

Cool.

But I still think it's mostly a hollow offering since they're the ones collecting and profiling us the most (or perhaps tied with Facebook).

Translation: I am convinced beyond help that Google is evil, I am trying to find any and all reasons to point out how evil they are. However, currently I am out of ideas.

Not that they're evil. I use Google for a bunch of stuff - personal email, search, adsense, analytics, and have for years. I just think it's a bit of a fallacy to protect us from 'someone else' knowing about us given the penetration they have into most internet users lives.

Their business model is to give you relevant ads based on information that you give them in exchange of using their service. They even let you opt-out[1] of their system so that they can't track you and give you relevant ads (enjoy tampon ads on programing page).

Better yet. Use noScript, ad-blocker, flash-blocker, don't use Google services (or at least use privacy mode on search), in addition to opting-out from Advertising cookie[1].

[1] Google Advertising Cookie Opt-out: http://www.google.com/privacy_ads.html

Double-click Advertising Cookie Opt-out: http://www.doubleclick.com/privacy/dart_adserving.aspx

As for me, the least I can do is to support a company, while not with a perfect track record, has championed and fought for an open web with plethora of free and exceptional services.

I can live with that, knowing that I have the option to opt-out whenever I want to.

Not exactly correct. If the URL you click on is HTTPS, then the referrer is sent. HTTPS->HTTP no referrer. HTTPS->HTTPS referrer (even if the domain changes). The encryption is preventing the network from seeing the data, not the remote hosts. If the browser sends the referrer encrypted, even to a different remote host, the network still can't see it.

Interestingly, the SSL version doesn't have the Pac Man game. ;)

Reply on news.ycombinator.com