![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Google SSL Search
May. 24th, 2010 11:30 amGoogle has added the ability to access their search engine via SSL. The interface couldn't be simpler -- you just go to https://www.google.com instead of http://www.google.com. The news media has been quite favorable to this -- after all, search queries are at least semi-private in that you might not want your employer or neighbors to know what you're searching for. With SSL searches, only Google knows what you're searching for. From a consumer-privacy perspective, it's a good thing.
On the other hand, search is not exactly something people have been clamoring for SSL on. Implementing SSL for large amounts of web traffic is not cheap (done right it's not terribly expensive, either, but it's an engineering effort at least,) so normally it's only done in response to either regulation or customer demand.
I think Google has an ulterior motive here -- possibly two of them. Current web browsers, as a privacy feature, will not pass extra headers from an SSL site to a non-SSL site or vice-versa. This means that if I click a link on the SSL Google site, the web site I clicked on will not receive a Referrer: header indicating what I had searched for on Google.
(Incidentally, yes, this does mean that right now every time you click a link or ad on Google, the site you click through to gets to see what you searched for. It's always been this way, most people just don't know it.)
There's a big business in website analytics. People run various statistics packages on their website to find out what searches lead to them, what sites link to them, etc. It's critical for optimizing marketing or advertising strategies. There are also several analytics services that will do this for you, including Google's own product Google Analytics. If everyone started using SSL for searches, all of these would be broken... well, except Google's of course, because Google Analytics doesn't need to rely on the Referrer: header -- it has the inside scoop from Google Search itself.
In addition to this, in the pay-per-click advertising world, conversion tracking is very important. One advertiser may pay for thousands of keywords and run dozens or hundreds of ads. They track each click all the way through to sales -- in other words, they look not just at which ads people click on, but which ads buyers click on, vs. ads that only attract browsers who don't follow through and purchase. Once again, these usually work via the Referrer: header, which SSL takes away. And once again, Google offers its own conversion tracking system, which will no doubt still work when all the others are broken. This one can be worked around -- you can make a third-party PPC conversion-tracking system that doesn't use Referrer:, it's just a little more work -- but not everyone will work around it.
Both of these results would mean, in a world where many searches were over SSL, rather than just a tiny fraction as it is today, that advertisers & webmasters would have the choice of either operating "blind" or giving all their data over to Google. And they have a very good reason not to want to do this -- if you're an ad buyer, and Google is the supplier you buy from, do you want Google to know exactly what keywords & placements are most profitable to you? Clearly Google can use this inside knowledge of their customers' businesses to maximize prices on the most effective advertising spots.
This is the sort of thing that can lead to an antitrust lawsuit. So far Google has managed to spin it as a consumer-friendly privacy feature, but we'll see if that lasts.
On the other hand, search is not exactly something people have been clamoring for SSL on. Implementing SSL for large amounts of web traffic is not cheap (done right it's not terribly expensive, either, but it's an engineering effort at least,) so normally it's only done in response to either regulation or customer demand.
I think Google has an ulterior motive here -- possibly two of them. Current web browsers, as a privacy feature, will not pass extra headers from an SSL site to a non-SSL site or vice-versa. This means that if I click a link on the SSL Google site, the web site I clicked on will not receive a Referrer: header indicating what I had searched for on Google.
(Incidentally, yes, this does mean that right now every time you click a link or ad on Google, the site you click through to gets to see what you searched for. It's always been this way, most people just don't know it.)
There's a big business in website analytics. People run various statistics packages on their website to find out what searches lead to them, what sites link to them, etc. It's critical for optimizing marketing or advertising strategies. There are also several analytics services that will do this for you, including Google's own product Google Analytics. If everyone started using SSL for searches, all of these would be broken... well, except Google's of course, because Google Analytics doesn't need to rely on the Referrer: header -- it has the inside scoop from Google Search itself.
In addition to this, in the pay-per-click advertising world, conversion tracking is very important. One advertiser may pay for thousands of keywords and run dozens or hundreds of ads. They track each click all the way through to sales -- in other words, they look not just at which ads people click on, but which ads buyers click on, vs. ads that only attract browsers who don't follow through and purchase. Once again, these usually work via the Referrer: header, which SSL takes away. And once again, Google offers its own conversion tracking system, which will no doubt still work when all the others are broken. This one can be worked around -- you can make a third-party PPC conversion-tracking system that doesn't use Referrer:, it's just a little more work -- but not everyone will work around it.
Both of these results would mean, in a world where many searches were over SSL, rather than just a tiny fraction as it is today, that advertisers & webmasters would have the choice of either operating "blind" or giving all their data over to Google. And they have a very good reason not to want to do this -- if you're an ad buyer, and Google is the supplier you buy from, do you want Google to know exactly what keywords & placements are most profitable to you? Clearly Google can use this inside knowledge of their customers' businesses to maximize prices on the most effective advertising spots.
This is the sort of thing that can lead to an antitrust lawsuit. So far Google has managed to spin it as a consumer-friendly privacy feature, but we'll see if that lasts.
