Also with and not against webmasters. Why should I buy a certificate for freecatpictures.com (hypothetical URL)?

So your super-popular freecatpictures.com isn't allowing people to hijack the connection and inject whatever they'd like into it.

@immibis You don't need to buy a certificate. You can just go to startssl.com or letsencrypt.org (coming soon) and get a certificate at no cost. And then an SSL cert for freecatpictures.com is a merely a half-hour endeavor (if that!)

@immibis because there are free options and Google ranks https pages higher (of course, there are still reasons for not encrypting it as well), but I am just giving some reasons as to why

... Google ranks HTTPS pages higher? That's a breach of my trust as an accurate search engine.

@immibis: Results from HTTPS pages probably are more likely to be relevant. Google doesn’t do things for no reason.

@minitech that's a rather bold claim, do you have a source?

@immibis: What, that Google doesn’t do things for no reason? Providing accurate search results is the whole point of the Google Search product, so….

@minitech No, that HTTPS results are more likely to be relevant. (But even if that's the case I'd expect Google to rank pages based on the content and links, not the protocol. Same content and links, same rank.)

@immibis: Well, it’s just something I’ve found when searching. Compare https: vs. http: results on google.com/search?q=google+chrome+download. Softonic, kisokea, cnet, ick. No HTTPS there, and they’re definitely all horrible. Scummy sites don’t buy certificates. (Many legitimate ones don’t either, but it’s still a useful metric, I’d think.)

@minitech Scummy sites absolutely would buy certificates, if doing so was a requirement to be ranked well in Google searches, or for people to access their site easily.

@minitech Also, shouldn't the fact that they still show up on the front page show that Google isn't penalizing HTTP?

@immibis googlewebmastercentral.blogspot.com/2014/08/…

@immibis Also, it's not just about relevance, it's about the overall user experience. Google's ranking HTTPS sites better for the same reason that they're ranking sites that load fast better: it's a better experience for the user.

@Ajedi32 My personal user experience with HTTPS is that it causes things to sometimes not work, sometimes load slower (no proxy caching), and sometimes display a green box in my address bar. Also, it prevents captive portals from working. (That is my user experience, which has nothing to do with anything I may know about security or programming). In other words, HTTPS gives a slightly worse user experience overall.

Captive portals do a MITM attack. They create a big usability problem, but if allowing them also allows all kinds of nastiness, I say to hell with them.

@immibis: I’m typing this from a school network, where all proxied connections are significantly (minutes vs. seconds) slower. HTTPS is super fast in comparison. (Of course, that’s also the case when I’m not behind a proxy, thanks to SPDY and such.) Have you actually done timing, besides? httpvshttps.com

HTTPS is definitely a worse user experience on slow links. On a congested link, I've timed HTTPS as taking 3x as long as HTTP to startup.

In fact I'm not sure there's any case where HTTPS gives a better user experience.

Just making a cert available for free won't do anything to shift the status quo more than a percent or two, at most you'll get Bob to install a cert on BobsCodeBlog.com because he knows it'll look good on his resume and it's no longer cost prohibitive to do so. Setting it up is still 30 minutes that the owner of freecatpictures.com would get more enjoyment out of spending cuddling with Mr Fluffy; assuming you could get him to stop cuddling long enough to hear your argument. Until https is the default config for FiveDollarMonthlyWebHosting.net the long tail of the web will be http.

@Ajedi32 MITM is a risk indeed, but you'd have to put this into context with how likely such an attack is and the risk incurred. Someone likely to click on malware from freecatpictures.com might also be likely to go and check otherfreecatpictures.com, with a proper cert but with site-endorsed malware. In addition, freecatpictures.com could itself be hacked or serve 3rd-party ads that include malware. (Somehow ad providers don't really seem to check what they server: last time I saw a machine infected, the malware came from an ad served by Skype...)