Hacker News Reader

Comment by daeken | Hacker News Reader

> I'll again state that this is why I feel so strongly that Google Analytics should be updated to be HTTPS by default

That's an incredible waste of bandwidth for no improvement in privacy whatsoever. If HTTPS pages were including GA over HTTP, then yes, this would be an issue, but you're already requesting the page over HTTP, if you're getting GA over HTTP. There's simply no advantage whatsoever -- for privacy, security, or anything else -- to using HTTPS for this script. It doesn't make any attack harder in any way, shape, or form -- it just makes pages slower and more expensive to load.

View on HN

The only significant overhead that TLS imposes is in the initial (public-key) handshake, and even then the overhead is primarily for high-traffic servers. Once a TLS (HTTPS) session has been established, it's essentially free to continue using it. Given that Google Analytics is basically everywhere on the web (and thus you can imagine your session would be fairly persistent as you're surfing around) and that Google can afford the server overhead of establishing TLS connections, I think your objections are unfounded.

Of course, you may still be right in that it adds no privacy, but I wouldn't call it an "incredible waste" (particularly not of bandwidth), since the cost is really quite low.

The cost is quite low for a single connection, but given that Google Analytics is on a huge portion of sites, that adds up really, really quickly. In addition, the additional roundtrips required for the TLS handshake is killer on a high-latency connection, seriously slowing things down for mobile devices.

Given that there really is no privacy benefit, I can't imagine why you would take on that overhead; Google clearly agrees, or they would've turned on HTTPS by default.

There is a major improvement to privacy in the larger scale: the Google Analytics servers are a funnel for a substantial percentage of all web traffic. Read the write-up I linked to, specifically "How does that help the NSA?".

Usage of unencrypted Google Analytics + Google cookies[1] means that you don't need to eavesdrop on individual connections, just one small set: the endpoints to the Google Analytics servers.

Hence, the NSA or other large entities have an economical way to tap a large portion of web traffic.

[1]: http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10...

> Usage of unencrypted Google Analytics + Google cookies means that you don't need to eavesdrop on individual connections, just one small set: the endpoints to the Google Analytics servers.

Admittedly, it is a smaller number of endpoints than monitoring every site in the world (that much is obvious), but it's not one or two -- they're all over the place.

But even ignoring that, it really comes down to one thing: Google Analytics can't possibly make an HTTP site any less secure or less private -- you're sending a postcard with your personal details on it a million times a second! It may in some situations make it slightly (very slightly) easier for someone to snoop on a tiny bit of info about your traffic, but the fix for this isn't to make that harder, it's to make it harder to snoop on your traffic entirely. We already have a solution for this: ubiquitous TLS.

IMO, this is slapping a band-aid where your arm used to be; trying to increase the privacy of HTTP sites is a fool's errand and a complete and utter waste of time.

Using HTTPS be default may encourage more people to adopt it.

Reply on news.ycombinator.com