top | item 9727366

Bing Moving to Encrypt Search Traffic by Default

83 points| Errorcod3 | 10 years ago |blogs.bing.com | reply

26 comments

order
[+] skrowl|10 years ago|reply
What's the point of encrypting the traffic in transit if you just PRISM (https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...) logs of it on the back end straight to the NSA? I guess this at least keeps random MITM attacks at bay?
[+] lern_too_spel|10 years ago|reply
By encrypting traffic, Microsoft ensures your queries will only be collected by a third party if you're being investigated by the FBI or some other government with a court order. Without encryption, anybody between you and Bing can see your queries.
[+] scrollaway|10 years ago|reply
The NSA is not every adversary.
[+] nivla|10 years ago|reply
Isn't Google part of it too? If you scrape out Google and Bing, what other good alternatives are you left with that wouldn't comply if requested?

Isn't it better to have some prevention against random MITM, especially on mobile devices where your choices are fixed? Like preventing tracking injections from your ISP (namely Verizon or Comcast)?

[+] shostack|10 years ago|reply
Outside of the privacy/security win for users and the PR win for Microsoft, it is likely to provide a business advantage depending on how they incorporate this data in Bing Ads.

Right now, you can get Bing organic query data in Google Analytics and other web analytics tools. This is invaluable to marketers, and even more so now that Google's organic data only shows up as "not provided."

If the Bing Ads team provides organic data within the Bing Ads platform like Google AdWords does, that is a reason to get people using their ad platform.

Not sure offhand if that data will exist in some form via Bing Webmaster Tools as well, but right now in Google land, the only two places you can get organic query data are AdWords and Webmaster Tools.

[+] j_s|10 years ago|reply
It pressures destinations to move to HTTPS if they want referer info (although Google also shimmed in a redirect to protect privacy / analytics premium... I don't know if it's Bing or one of my add-ons that's leaving direct links.)
[+] willscott|10 years ago|reply
It would also be fascinating to know what sort of compromises if any are needed to allow this change to occur for operations in China.
[+] asanagi|10 years ago|reply
Encryption doesn't just protect your message in transit. It also positively identifies you as a sender.

This way, the feds not only get the contents of your searches, but they can positively prove that you are the one that initiated the search, so they can lock up "subversives" that much more easily.

[+] taf2|10 years ago|reply
Amazing that so much attention is given to the NSA here... To me a more interesting question is how will this impact keyword data that's pasted through the referring URL? Will we be losing bing.com as a referrer on iOS similar to google.com?
[+] themeek|10 years ago|reply
> Amazing that so much attention is given to the NSA here..

Well, the topic of default encryption is related to a mass global surveillance network supported by data collection capabilities built into the internet backbone - and HN is concerned about what these technical capabilities could mean for a runaway government or in the hands of adversarial entities/governments/groups. It's an incredibly important topic, so I'm glad there's some chat about it.

> To me a more interesting question is how will this impact keyword data that's pasted through the referring URL?

Doesn't Google have a redirect mechanism that allows referrer information to pass through when a 'blue link' is clicked?

[+] rand334|10 years ago|reply
Microsoft is still a PRISM company, so I'm sure the NSA will still be able to access search data.
[+] ausjke|10 years ago|reply
Does this simply mean you now do https://bing.com for searching? which google has been doing for a while?
[+] finnn|10 years ago|reply
And yet on their blogpost announcing it, they use insecure resources and blogs.bing.com is only https if you manually specify the https, so it's basicaly not SSL'd.