Encrypted Google Search (Beta) Launched

[engine]

Encrypted Google Search (Beta) Launched [googleblog.blogspot.com]

And today we’re gradually rolling out a new choice to search more securely at [google.com....]

When you search on [google.com,...] an encrypted connection is created between your browser and Google. This secured channel helps protect your search terms and your search results pages from being intercepted by a third party on your network. The service includes a modified logo to help indicate that you’re searching using SSL and that you may encounter a somewhat different Google search experience, but as always, remember to check the start of the address bar for “https” and your browser lock indicators:
Today’s release comes with a “beta” label for a few reasons. First, it currently covers only the core Google web search product. To help avoid misunderstanding, when you search using SSL, you won’t see links to offerings like Image Search and Maps that, for the most part, don’t support SSL at this time. Also, since SSL connections require additional time to set up the encryption between your browser and the remote web server, your experience with search over SSL might be slightly slower than your regular Google search experience. What won’t change is that you will still get the same great search results.

A few notes to remember: Google will still maintain search data to improve your search quality and to provide better service. Searching over SSL doesn’t reduce the data sent to Google — it only hides that data from third parties who seek it. And clicking on any of the web results, including Google universal search results for unsupported services like Google Images, could take you out of SSL mode. Our hope is that more websites and services will add support for SSL to help create a better and more consistent experience for you.

Earlier coverage

"Earlier this year, we encrypted Gmail for all our users, and next week we will start offering an encrypted version of Google Search..." [webmasterworld.com]

[lammert]

Tried the first search on [google.com...] to go to one of my own pages. The referrer field sent with the HTTP request is blank. This is secure and protects the privacy of the surfer, but for a site owner it's very inconvenient. If a substantial group of people convert to the encrypted Google version, statistics won't be reliable anymore and keyword analysis of search engine referrer URLs will become useless.

[cwnet]

Another nail in the coffin of traditionell SEO - I Wonder if referrer info will still show up in GA though?

[J_RaD]

This would force you to use google analytics creating a back door for goog to know everything that is feeding your site.

keyword tools and server side analytics will be trashed. Now webmasters must rely on goog's cloud?

[graeme_p]

For that very reason I suspect competition regulators would have something to say of Google Analytics got information their rivals could not get.

[blend27]

So if my client that Advertises on Google asks me to confirm that there were 666 clicks from Google Ads for "Looney bin" - using Raw Server logs I would not be able to do so because half the users used HTTPS?

Can I then Have IP of the Users that clicked on My Ad? or will the data be provided for a mere 3 more cents per lick? Or will it be TRUST GOOGLE STATS Guacamole?

I understand SSL, Form Data Encryption thingy. And maybe I am missing something, but Hiding a Referrer, adds ZILCH to users security.

The only one who benefits from this would Gorg. I bet they will expand into Cheap SSL Certificate, Eggplant and Zucchini Businesses next…

What's that word for forcing the masses to be dependent on you when you have a most upper hand in the industry?

Before I was under the impression that they might be hiding something, I will know that they are hiding something, for SURE. Oh, and while you at it disable RIGHT CLICK and Open UP bunch up Public Proxies...

secured channel helps protect your search terms and your search results pages from being intercepted by a third party on your network.

Exactly, My website is the THIRD PARTY Network.

[J_RaD]

goog has made no attempt to cover up that webmasters are on its list of things to erase. (look what they did to affilate marketers)

once they find a way move their big adsense accounts onto google servers they can really start smacking the rest of us around.

As i've said before, if goog keeps going down this path it will only be goognet and the internet, they are creating a divide.

[sean22]

I'm grateful I read this post. I use an analytic program and quite a few referral URLs are returning without the search terms or the page placement. Also when clicking on the link I am directed to a Google Redirect Notice page with two links, the top link directs me to my website and the second to go back.

I thought I was hacked or something. Very inconvenient because it was a quick and easy way to analyze traffic.

[zeus]

hmm I dont see any reason to use such thing when Google still gets the data or is it a new way to mis guide normal users that now you will not be spied on.

[TheMadScientist]

I dont see any reason to use such thing when Google still gets the data...

I've had a similar though... Turing Off Personalization [webmasterworld.com]

[tangor]

< moved from another location >

Google has added SSL encryption to its primary search engine.

Today, with a blog post, the company announced that netizens now have the option of establishing a secure https connection when searching google.com. To use the service, you must explicitly visit [google.com...] (Notice the extra "s"). At time of writing, the link was being redirected to Google's default, unencrypted search page on our computers. A spokesman says the SSL service is being rolled out gradually on Friday.

[theregister.co.uk...]

[edited by: tedster at 10:51 pm (utc) on May 22, 2010]

[zett]

This probably shall just distract from the fact that Google itself is the danger, not the intermediary routers. I'm hardly using Google anyway these days, which I think is the best protection against the data collecting behemoth.

[tedster]

The Register article that tangor linked to above also had this to say:

A Google spokesman also indicated it plans to make SSL encryption the default for search. "We hope to expand the functionality once we better understand how it affects users' search experience," the spokesman told us.

So there we have it. Referrer information in our server logs has only a short time to live, unless there's a change in disposition from the 'plex. I do hold onto a slim thread of hope, because when the AJAX code in SERPs messed with referrer information, they did back out of that move. This may be another case of one team having no communication with others, and no conception of all the repercussions of their "innovation".

And where are all those voices complaining about search referrer information being intercepted? Did I miss hearing that complaint? It's not even close to the top of privacy concerns with Google.

[tedster]

Some time in the past year or so, I believe Google announced development of their own secure protocol that was to be faster than SSL (anyone got a link for that?)

I wonder how that might tie in to the Big Picture.

[tangor]

I have problems with all eggs in one basket... the eggs these days is our logfiles being dominated by one basket that is getting more broken every day (g) which is why I have personally changed (via email suggestion or access to a corporation's browsers--with their permission) more than 1,000 default search to go (b) a different direction.

Thanks, tedster for splicing mine and following into this thread. We don't need competing threads.

[Wynne]

Could be a game changer if google obfuscates the referrer. Even more reasons to not advertise with them if you ask me.

[blend27]

Seriously, we do our best in e-com field to cater to what people search on the site that feeds of our content.

Why come up with a kakamimia security excuse/20 minute patch on the day when FaceBook and MySpace get busted by Media for not following the security protocols?

What’s in it for the user if they arrive to my site with the blank Ref, I can't offer the user additional content/products from my site related to their long tail search query(BTW, gone in 60 second a while back as a lot of people are saying)/short tail search.

Should I Bann all the users with Google Tool Bar instaled too from our ecommerce sites?

Does Google think that it is up to them to change stuff around when most of the webs E-com Eco system depends on their traffic?

What happens when the entire WebMaster Community revolts to NoReferrer Trafic? And what happens when we really say BUSTA Googleo and start serving 403s to GBOT? Whould they call it googleusercontent then?

Twisting a hand, and That is just Cold.

0.

[jskrewson]

I am very upset about the potential loss of keyword referrer data. I too use the referrer data to refine my landing page based on exactly what the user wants. When this data is gone, the user experience on my site is going to suffer.

For those people who are running adwords, this also hides traffic sources, especially via the search partner network or content network. We aren't going to be able to help Google police PPC fraud or lower quality adsense partners, which in turn will lower the quality of the Google experience.

[lammert]

I didn't run extensive tests yet, but the Google referrer missing appears to be a browser issue rather than a Google issue. Most browsers block sending a referrer to a HTTP page if the source page is HTTPS. This can be circumvented by offering your site via SSL rather than unencrypted.

SSL certificates start somewhere around $20 per year, which isn't much for any decent money generating site where the webmaster wants access to the referrer info in the server logfiles, but it is a massive investment for all those domain parkers, typo squatters and other borderline Internet entrepreneurs who rely on domain quantity rather than quality. Instead of a few dollars per year for domain registration they now face a minimum $25 investment per domain if they still want referrer info for their sites.

This may therefore be a clever move of Google to separate the legitimate Internet businesses from those who try to cheat.

After all there is no technical reason anymore to not serve all websites through SSL, except for the one IP per site issue. A few years ago server side CPU power was still a limiting factor, but with current multi-core processor setups most websites are limited by harddisk and network bandwidth now, rather than CPU power.

[tangor]

start somewhere around $20 per year

Do we see a new cottage industry for G? Kiss my...

[blend27]

@lammert

-- to separate the legitimate Internet businesses from those who try to cheat. --

I and people i(little me) deal with, don't hide(as an e-com store), nor my clients(as e-com stores), nor the people I am in competition with(as e-com stores).

What's there to separate? a 3 weeks old site with 50000 backlinks and 10000 pages of thin content? Or perhaps an 8 year old site that uses Shared SSL certificate that is offered by a hosting account(GoDD for example), or perhaps the one that was told not to have your site crawlable via mydomainaccountname.hostingssldomain.tld?

I am going at it 100%, this is what an average, GorgBrainwashed site owner would ask. Sorry, no mercy here.

[added]
For the past couple of weeks, i see the threads on WebmasterWorld homepage get shifted as far as a position to the top goes. CAN WE PLEASE keep this one on top. Pretty please!
[/added]

[lammert]

I was not trying to upset anyone, especially not e-com store holders. Google SERPs served via SSL will function just as they did before and send just as much traffic to the listed sites.

The difference is that access to referrer data will be filtered by the visitor's browser, unless the landing page Google is sending the visitor to is also SSL encrypted. Many e-com sites already have SSL certificates in place and for many other sites the financial impact of an investment in one is not a big issue, compared to their income stream. And there is also a large group of webmasters which don't care about search engine referral keywords at all.

Only those living from throw-away domains, parked domains and other types of sites where initial setup costs are substantial compared with the prospected income per domain name may see a drastic change in their ROI if access to the SE keywords is essential for their business operation.

[arizonadude]

This just goes to show the very people who have supported Google over the years, that they really don't care about you.

If Google had their way, there would not be other websites on the Internet, it would all be Google sites housed on Google servers. That's the problem when you get so many smart people in the same building.

Nothing against PHD holders, but I've worked with several very intelligent PHD types and while they were extremely smart bookwise, at the same time they were also some of the dumbest people I have ever known when came to every day rational thinking. Not to say their all like that, but with so many all togethter, it's a recipe for disaster.

[tedster]

I'm not following you all the way. It's certainly true that legit e-commerce uses SSL for their checkout pages, but they usually don't serve landing pages, article information and the like with an https: protocol.

So in order to get the browser referrer data, won't they need to serve ALL their landing pages as https:? And doesn't that mean a complete re-indexing and re-ranking of the site, with 301 redirects and all that complication?

[Reno]

And doesn't that mean a complete re-indexing and re-ranking of the site, with 301 redirects and all that complication?

And at what point do we STOP living our online lives based on what Google wants? I mean, enough is enough. If we build correctly coded sites that validate and have decent content and reasonable backlinks and remain relatively fresh, then that should be adequate for them or anyone else. They wanted rel=nofollow so we went through our pages and gave it to them; they decided that peer-to-peer link trading would be devalued so we mostly stopped doing that; now they want this -- how long before you'll have to get a Google Visa Card to pay for your Google site hosting for your Google registered domain?

.....................

[cmendla]

I think this encryption gives a false sense of security. Some less savvy users might think that using the secure mode will protect them even after they click on a search result.

I can picture some guy at work thinking "Oh cool, I'll use the super duper secret google search to search for bikini pics and my stupid boss will never know". However, there will be a whole trail of suspicious URLs leading back to his machine.. Ooopsie one more in the unemployment line.

[tedster]

The fact is that most online business does depend on Google traffic. If that changes, then Google can't call the shots so powerfully. Right now, our customers have given Google the power that they have.

If you can build an online business that doesn't depend on Google (or any) search traffic to thrive, that's all good for you. I work with a few businesses like that - and they depend on a long term marketing plan with email lists, viral communication, and all manner of customer retention and service mechanisms.

They do make use of whatever search traffic Google sends, but they don't chase it. I check certain key rankings for them about twice a year - and that traffic could dry up overnight and they would still be OK. I'd say that approach only works for some markets, however. It's worth considering the ways that any site can diversify its traffic sources and income stream.

This https thing is brand new - and to a degree we're getting ahead of ourselves trying to think through through all the possibilities. It's not worth any excess stress right now, but it is worth some intelligent investigation and planning.

[lammert]

Tedster, you are right that for existing sites where currently only the checkout process is SSL encrypted, regaining access to the Google referrer data would mean a re-indexing of the unencrypted pages and to reuse existing link juice a 301 redirect to the SSL encrypted page versions. New sites are easier in that respect as there is no conversion to take place, only initial setup.

Let me say that I am not proud of this solution but it is currently the only feasible solution I see to receive Google's referrer information once searchers switch to [google.com....]

The only possible other alternative is when Google decides to provide the SERPs through https:, but serve all outgoing links through a http: based URL redirector. I am not sure how that would impact on browsers though. They still might decide to filter the referrer info due to the https: to http: transition in that process.

[walkman]

Funny, I fear what google does with the data once I search, not someone trying to intercept my keyword while going to Google's servers.

[Lame_Wolf]

Thing is, how are they going to market it to the public?
It's not as if you will go to Google and they will give you a choice. Maybe they will, but cannot see it.

Plus, most will have Google already bookmarked or using the toolbar. I cannot see it being much of a problem. YMMV