Bing now supports https

Not only did it not support secure connections (which on its own is kind of shitty, but not laughing-stock material IMO), but it also failed to fail elegantly when you attempted to make a secure connection.

bedspax• 13 years ago

Wow… I wasn't waiting for anything else.

semenko• 13 years ago

They get an A from Qualys (yay?): https://www.ssllabs.com/ssltest/analyze.html?d=bing.com

… but no PFS :/

aabalkan• 13 years ago

LOL even my blog with free SSL cert from startssl gets A. I suppose that's nothing to brag about. https://www.ssllabs.com/ssltest/analyze.html?d=ahmetalpbalka...

booi• 13 years ago

Setting up SSL/TLS on a single server in a virtual environment that you don't even have to manage is a different story than getting major changes tested and deployed on a huge multi-billion dollar, multi-tenant distributed system spanning not just the globe but multiple teams, languages, people and requirements.

lucb1e4• 13 years ago

In my opinion, anyone should be able to get an A with a free certificate, or at least nothing beyond administration costs. Certificates cost nothing to make. Anyone paying a dime is just helping keep up the illusion that it is expensive.

zokier• 13 years ago

Next step: enable perfect forward secrecy :)

alphex• 13 years ago

I saw this on twitter, and was confused. (Twitter removed the HTTPS in the url it shows... so now it makes sense.)

ateevchopra• 13 years ago

finally my neighbour cannot see what i bing ! huh ?

higherpurpose2• 13 years ago

Don't forget to add PFS, Microsoft. And no NIST-corrupted curves, please.

tptacek4• 13 years ago

In other words, don't use elliptic curves? And, therefore, don't use forward secrecy? Does current browser support for curves even allow you to set up a "NIST-free" ECDHE TLS server?

pbsd• 13 years ago

There's also DHE, which is not "NIST-corrupted" I guess. As far as I know, in theory it should be possible to use the Brainpool curves in TLS, but haven't seen such a thing in actual use.

higherpurpose2• 13 years ago

You're using the same argument RSA used when they decided to just keep Dual EC DRBG, because it was "too late to change", even though they knew it was a backdoor. Granted, I think they are lying and did it on purpose, but even their lie is pretty bad logic.

They need to talk to Google, Mozilla and others, and decide on using a new set of safe curves in their browsers. Using a broken one is not a solution.

d0ugie• 13 years ago

So, why stop short of implementing PFS? An oversight?

nivla• 13 years ago

Issuer: "Microsoft Internet Authority"

Just like with Google: Google Internet Authority. Interesting to see big companies not trusting intermediate CA's anymore that they go through the length of becoming a CA themselves. However it could also be a cost effective strategy.

dublinben• 13 years ago

With the amount of subdomains they use, and seeing as they each have a browser with significant market share, it's a no-brainer. I'm frankly surprised it took so long for them to bring such an essential security task in-house.

lucb1e4• 13 years ago

Wildcard certificates.

nacs• 13 years ago

Also, not just for HTTP either since they can sign their own software binaries with it too.

Probably cheaper for them to be their own CA long term.

pwnna• 13 years ago

Well that certificate comes from the Baltimore Cybertrust Root certificate. Doesn't that mean MS is just an intermediate CA?

gtklocker• 13 years ago

The SafeSearch setting isn't saved on https. Did they even test this thing before pushing it out?

diziet• 13 years ago

Good to see Microsoft making progress on this!

dudus2• 13 years ago

no document.referrer. So this is untrackable. I think it's a shame, search engines should pass a referrer and hide searched term for privacy.

prodigal_erik• 13 years ago

I thought this was inherent in following a link from a https resource to a http resource with a different authority, that the browser would never expose the secure URL (via header or script state) to the insecure content.

RKearney• 13 years ago

This is correct. Browsers will not send the referrer header when moving from HTTPS to HTTP URIs. This can easily be solved by just converting your website to HTTPS only at which point search engines will index your HTTPS URLs and you will begin to receive referrer headers once again.

dudus2• 13 years ago

The goal is to avoid leaking information on the url that might be sensitive. The fact that the user is coming from bing is not sensitive, and this might be important for webmasters. The query might be sensitive and thus should be stripped.

lucb1e4• 13 years ago

They didn't yet?!

Bing now supports https

Related Stories