http://www.bbc.co.uk/news/technology-30505970 (http://www.bbc.co.uk/news/technology-30505970)
QuoteGoogle considers warning internet users about data risks
Google is proposing to warn people their data is at risk every time they visit websites that do not use the "HTTPS" system.
Typically passive aggressive, but it's clear that Google want everyone to invest in SSL certificates.
There are two huge wins by Google doing it and one small one.
- Automated site verification that they don't need to invest into
- A big middle finger salute to the NSA over what they did with their MITM attacks on the G infrastructure
- A slight cost penalty to webmasters likely delivering less spam
>A slight cost penalty to webmasters likely delivering less spam
I'm thinking that's the main motivation there. It's like a big filter to remove a good percentage of low cost content.
> >A slight cost penalty to webmasters likely delivering less spam
I think we disagree here. I see that as a pleasant side effect and extremely short term in nature. SSL certs cost almost nothing at present, and the costs of them will dive deeper down, and in reality to nill, when services like https://www.letsencrypt.org/ go live and the competition reduce their prices to counteract the loss of business.
I also think that search, although a primary driver of business for G and where it has its roots, is a child they have left to grow up on its own, being more interested in other areas. Overall, the spam isn't too heavy in the SERPs IMO.
I can't find the reference, but I thought recently there was a Google-backed initiative to also offer free certs.
There has been one for years but I found it such a hassle to use that it was easier to just buy a cert now that they can be had for under $10.
[edit - I was thinking of http://www.startssl.com/ ]
So I agree that long term there won't be an expense, just an additional setup step.
>>Overall, the spam isn't too heavy in the SERPs IMO.
I know people disagree, but I think the spam wars have largely been won. I know Jason read the article I posted a while ago on the email spam wars and that tracks with my experience - I never get any email spam in my inbox anymore and only a few false positives in my spam folder.
Granted, deliverability has gone down and if you don't have SPF and DKIM set up right, lots of people are not going to get your mail.
With regard to the SERPS, back in 2008 I found Google becoming an unusable cesspool of spam. I was still doing research then and had to look up a lot of French place names and for anywhere obscure the results were nothing but spam. Those are all gone. That battle has won. Now it's over lesser and greater quality.
Forcing HTTPS on everyone is not exactly like forcing SPF and DKIM, but it has its analogies.
One thing about cost too, is that right now one of the "costs" is the speed cost. If HTTP 2.0 or SPDY ever get rolled out generally, that "cost" will fall to about zero and there will be no compelling reason other than laziness to not be running https for every site.
PS, when I say "the spam wars have been won" I don't mean clever people can't still get spam ranked
<snipped link just because the thread name actually gave the some detail and its in members only - sorry Ergo - just being sensitive! Thread is active in members if anyone wants to find it :) Gurtie>
I mean that it is now rare enough that we actually have threads about someone doing it!
> I mean that it is now rare enough that we actually have threads about someone doing it!
Agreed :)
> Forcing HTTPS on everyone is not exactly like forcing SPF and DKIM, but it has its analogies.
Great example and Moores law has placed the perceived speed differences into a position where the differences aren't noticeable by the end surfer.
And just like when SPF and DKIM are used you have verifiable ownership information, alongside NAP (Name, Address & Phone numbers) to use. It's much harder to abuse and is a mine of verified information waiting to be added to the borg..
Good points both of you. But doesn't having HTTPS require a dedicated IP? I'd think that that would add up in hosting cost in mass even if the certs are getting cheaper.
> Dedicated IP
Not any more and the support across browsers is pretty good too.
http://en.wikipedia.org/wiki/Server_Name_Indication#Support
Good to know, thanks Jason.
SNI is one of the reasons we want Windows XP to die!
It is really the last obstacle to universal acceptance of SNI
http://www.webmasterworld.com/website_technology/4531941.htm
http://www.webmasterworld.com/website_technology/4656679.htm