Hacker News Reader

Comment by pierrefar | Hacker News Reader

I work at Google in web search. It's great to see another example of a site indexed under HTTPS as it's a common question we see. Sadly, for such an important topic, there are many myths.

I didn't dig into this particular example, so a couple of things about the topic of this post:

1. As much as I'd personally would love to see it happen, we currently don't give any ranking boost or demotion based on whether the site is HTTPS or HTTP. Regardless, it's a good thing to do for your users anyway, so please do it if you can.

2. Fellow Googler Ilya Grigorik, who's also on HN, and myself gave a talk about HTTPS two weeks ago at I/O. We covered a lot of topics about how to deploy HTTPS in a secure and fast way, and also how to get Google's indexing algos favor the secure site. It's here:

http://www.youtube.com/watch?v=cBhZ6S0PFCY

Happy to answer any questions here.

View on HN

I had this debate on my last project: Does Google consider http and https on the same host to be separate sites? Assuming http://www.example.com/home and https://www.example.com/home return the same content, are they considered one page or two?

Hi tootie

These are two sites. In reality, most secure sites have four variants:

http://www.example.com

http://example.com

https://www.example.com

https://example.com

You should watch the I/O video about what to do here for optimal indexing. Briefly, redirect all variants to just the one, but there is a lot more you need to watch out for. It's all in the video.

But why?

So we have two websites on the same server (same IP, using SNI), siteA has SSL, siteB doesn't. Google will attempt to crawl https://siteB/ (which will return siteA's content! in a browser you would get a warning about the certificate being wrong). Since there are no links anywhere that point to https://siteB why does google crawl it? This is technically a configuration / apache error, but google should not be crawling https websites when their domain does not match the certificate.

Hi return0

This means that at some point Googlebot discovered https://siteB. It could simply have been a misconfigured CMS, or a bad sitemap, or an errant link one of your visitors shared on a forum, or something a previous owner of the domain did, or anything really. You may think there are no links to the site, and that may be true right now, but it's about something that Googlebot found in the past.

The correct fix is, as you say, to make sure the server doesn't respond to invalid certificate+site combinations.

Are you in a position to request that these two videos are removed from the privileged access section of the GV Library? Definitely the top two videos I wanted to watch from there, and it seems like better security practices is a win for everybody. * http://www.gv.com/lib/security-for-startups * http://www.gv.com/lib/advanced-security-for-startups

The scary thing is that I started writing an article about this on the 28th, all due to a comment I was sent by an advertising agency stating that "HTTPS is only really for checkout pages". I nicely pointed out why they were wrong.

It was mentioned somewhere that if Google started giving priority to full HTTPS sites, there would be a mass scramble to convert web sites to support HTTPS. Isn't this what we want?

You can warn people all you like, but until it starts to hurt them, they won't listen.

google can easily help spread https more by offering:

  * free ssl cerf.
  * free/low cost https proxy / caching proxy for small websites.

especially for mobile app websites.

Reply on news.ycombinator.com