Bing Moving to Encrypt Search Traffic by Default

https://blogs.bing.com/webmaster/2015/06/15/bing-moving-to-encrypt-search-traffic-by-default/

by Errorcod3 • 11 years ago

83 26 11 years ago

blogs.bing.com

skrowl• 11 years ago

What's the point of encrypting the traffic in transit if you just PRISM (https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...) logs of it on the back end straight to the NSA? I guess this at least keeps random MITM attacks at bay?

j_s• 11 years ago

It pressures destinations to move to HTTPS if they want referer info (although Google also shimmed in a redirect to protect privacy / analytics premium... I don't know if it's Bing or one of my add-ons that's leaving direct links.)

shostack2• 11 years ago

Do you have a source on GA Premium being a driver behind the secure search change? Everything I've seen says that is not available to GAP customers.

vgeek• 11 years ago

Not exactly. HTTPS to HTTPS sessions should provide referrer information, but not with Google.

See: https://yoast.com/web-https/

Google SERP links are different in Chrome especially. Hover the link and you see one address, but copy the link URL and you'll see a number of parameters in addition to just the site URL. AFAIK, GA Premium is $150k/year and the sales rep I spoke with didn't allude to any solution to not provided.

Don't get too comfortable if you're on the paid side, either. Adwords disabled exact match keywords a few months back. They now include 'similar' keywords, but that is just another black box similar to the QS system that they have always used to manipulate CPCs.

scrollaway• 11 years ago

The NSA is not every adversary.

stephengillie• 11 years ago

No, but they're a funnel to many. Simply by them collecting or holding the data, it becomes available to numerous agencies from numerous governments, and also to hacking groups.

shostack2• 11 years ago

Outside of the privacy/security win for users and the PR win for Microsoft, it is likely to provide a business advantage depending on how they incorporate this data in Bing Ads.

Right now, you can get Bing organic query data in Google Analytics and other web analytics tools. This is invaluable to marketers, and even more so now that Google's organic data only shows up as "not provided."

If the Bing Ads team provides organic data within the Bing Ads platform like Google AdWords does, that is a reason to get people using their ad platform.

Not sure offhand if that data will exist in some form via Bing Webmaster Tools as well, but right now in Google land, the only two places you can get organic query data are AdWords and Webmaster Tools.

nivla• 11 years ago

Isn't Google part of it too? If you scrape out Google and Bing, what other good alternatives are you left with that wouldn't comply if requested?

Isn't it better to have some prevention against random MITM, especially on mobile devices where your choices are fixed? Like preventing tracking injections from your ISP (namely Verizon or Comcast)?

Cyph0n• 11 years ago

DDG might not comply. Yandex most likely won't. DDG uses Yandex results if I'm not mistaken, so no big difference.

asuffield• 11 years ago

(Tedious disclaimer: my opinion, not my employer's. Not representing anybody else. I work at Google.)

We have made multiple extremely clear statements on this topic. I link a couple of them here:

http://googleblog.blogspot.com/2013/06/what.html http://venturebeat.com/2013/06/19/google-issues-clearest-sta...

lern_too_spel2• 11 years ago

By encrypting traffic, Microsoft ensures your queries will only be collected by a third party if you're being investigated by the FBI or some other government with a court order. Without encryption, anybody between you and Bing can see your queries.

themeek3• 11 years ago

Well, that's generous. You don't have to be specifically investigated by the FBI (just 'related') and the court orders used to make requests can be quite large and in practice are primarily automated. If you look at the sort of processing the NSA is talking about they are discussing large scale sentiment and social media analysis (of the sort that non-related folks must be included). On this line we know that anyone 'three hops away' was considered legally relevant to an investigation. It was shown in the Snowden documents that NSA hacked into backend databases of US corporations to collect data - which gave data access with no warrant. Finally, companies are encouraged to give data to the government as a gift. This gifting of data is not compulsed legally and is outside the scope of (weak) legislation by FREEDOM providing some small limitations on bulk collection requests.

willscott• 11 years ago

It would also be fascinating to know what sort of compromises if any are needed to allow this change to occur for operations in China.

pki• 11 years ago

Some major chinese browser doesn't validate any cert at all, even self signed is perfectly OK (360 Browser, very large install base)/

asanagi• 11 years ago

Encryption doesn't just protect your message in transit. It also positively identifies you as a sender.

This way, the feds not only get the contents of your searches, but they can positively prove that you are the one that initiated the search, so they can lock up "subversives" that much more easily.

finnn• 11 years ago

And yet on their blogpost announcing it, they use insecure resources and blogs.bing.com is only https if you manually specify the https, so it's basicaly not SSL'd.

taf2• 11 years ago

Amazing that so much attention is given to the NSA here... To me a more interesting question is how will this impact keyword data that's pasted through the referring URL? Will we be losing bing.com as a referrer on iOS similar to google.com?

themeek3• 11 years ago

Amazing that so much attention is given to the NSA here..

Well, the topic of default encryption is related to a mass global surveillance network supported by data collection capabilities built into the internet backbone - and HN is concerned about what these technical capabilities could mean for a runaway government or in the hands of adversarial entities/governments/groups. It's an incredibly important topic, so I'm glad there's some chat about it.

To me a more interesting question is how will this impact keyword data that's pasted through the referring URL?

Doesn't Google have a redirect mechanism that allows referrer information to pass through when a 'blue link' is clicked?

zyx321• 11 years ago

Last I checked, the only way to get the search keywords from those redirects was registering for Google webmaster tools.

rand334• 11 years ago

Microsoft is still a PRISM company, so I'm sure the NSA will still be able to access search data.

ausjke• 11 years ago

Does this simply mean you now do https://bing.com for searching? which google has been doing for a while?

Bing Moving to Encrypt Search Traffic by Default

Related Stories