Email
Google is to demote sites in its search results which don’t use secure connections by default.
Webmasters will have to enable HTTPS, a method of browsing the internet which prevents eavesdroppers from reading the communication between the server and visitor, or risk losing their positions on Google search results to other sites who do.
“Over the past few months we’ve been running tests taking into account whether sites use secure, encrypted connections as a signal in our search ranking algorithms,” the company explains on its Webmaster Central blog “We’ve seen positive results, so we’re starting to use HTTPS as a ranking signal.”
HTTPS, also known as HTTP over TLS, is the most common security standard on the internet. Many will know it from its use on e-commerce sites and online banking, where they have been trained to look for a padlock symbol in their browser to ensure that a site is safe.
But the privacy groups have long been calling for HTTPS to be used everywhere – even on websites which, at first glance, don’t need to offer the same level of protection to their visitors as banking might.
The Electronic Frontier Foundation, which makes a plugin that lets users easily enable HTTPS on sites which don’t offer it by default, explains the advantage: “Ideally, this provides some protection against an attacker learning the content of the information flowing in each direction — for instance, the text of e-mail messages you send or receive through a webmail site, the products you browse or purchase on an e-commerce site, or the particular articles you read on a reference site.”
For the time being, Google won’t be penalising sites heavily if they don’t enable HTTPS. The company describes it as “a very lightweight signal — affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content”. But once webmasters have been given time to switch their sites over, the search firm warns that “we may decide to strengthen it, because we’d like to encourage all website owners to switch from HTTP to HTTPS to keep everyone safe on the web.”
“Data in a plain-text state is easily readable,” says Jason Hart, the vice president of of Cloud Solutions, at cybersecurity firm SafeNet, “so any website that’s storing or transmitting user credentials or data in plain-text is putting customers’ data, and the company’s reputation, at risk.
“Previously organisations have shied away from encryption due to cost concerns or fears of slowing website response times. But there are now high speed encryption technologies available that mean cost and speed need no longer be an issue. So there really is no excuse for any data to be transmitted or stored in plain text.”
• Google could end China’s web censorship in 10 days – why doesn’t it?
;