Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)?

In terms of security what were the benefits of browsing through encrypted Google search?

Note that this is not a question about HTTP vs HTTPS. These are two Google services.

share|improve this question
21  
This is about encrypted.google.com vs google.com, not http and https. –  Henning Klevjer Mar 10 '13 at 15:21
3  
There's no top navigation bar in encrypted. –  John Isaiah Carmona Mar 11 '13 at 9:35
2  
@John Whoa. I’ve made this my default search engine now. I don’t care about referrers (I’ve disabled them anyway) but the missing top bar is a killer feature. –  Konrad Rudolph Mar 11 '13 at 10:51
    
@KonradRudolph The http referer header is one of the most useful things for webmasters. If you come from a https website it's not sent anyway, so no data is leaked. You may consider enabling it again for our sake. –  Luc Jul 2 '13 at 20:53
4  
@Luc It may be useful but it’s also a crass invasion of the user’s privacy. A website generally has no business knowing how I get there. I agree that it’s useful for the website to know but only in rare instances does the user profit from that. –  Konrad Rudolph Jul 2 '13 at 20:55

2 Answers 2

up vote 91 down vote accepted

According to Google, the difference is with handling referrer information when clicking on an ad.

After a note from AviD and with the help of Xander we conducted some tests and here are the results

1. Clicking on an ad:

  • https://google.com : Google will take you to an HTTP redirection page where they'd append your search query to the referrer information.

  • https://encrypted.google.com : If the advertiser uses HTTP, Google will not let the advertiser know about your query. If the advertiser uses HTTPS, they will receive the referrer information normally (including your search query).

2. Clicking on a normal search result:

  • https://google.com : If the website uses HTTP, Google will take you to an HTTP redirection page and will not append your search query to the referrer information. They'll only tell the website that you're coming from Google. If it uses HTTPS, it will receive referrer information normally.

  • https://encrypted.google.com : If the website you click in the results uses HTTP, it will have no idea where you're coming from or what your search query is. If it uses HTTPS, it will receive referrer information normally.

The same topic was covered in an EFF blog post.

share|improve this answer
9  
One benefit of this: copying a link from a Google search result will give you a link to a webpage, not the jumbled mess of a redirect link. –  paraxor Jul 2 '13 at 18:05
1  
@EvanTeitelman The link becomes a redirect when I click on it. –  curiousguy Sep 20 '13 at 18:13
    
@Adnan, So this is all? I mean, they built encrypted.google.com just to do that referrer thing? –  Pacerier Jun 9 at 22:01
    
@EvanTeitelman, No it doesn't work, try it. –  Pacerier Jun 9 at 22:05
    
@Pacerier Originally, no. The encrypted. domain was where Google first rolled SSL support. However, after they added SSL support to the main domain, that became the distinction. –  Adnan Jun 10 at 7:01

At the time of writing (July 2013), the two sites have different preferences for key exchange algorithms. To inspect in Chrome, click the padlock icon and select the 'connection' tab.

Against Chrome 28, normal Google uses ECDHE_RSA, novelty Google uses ECDHE_ECDSA. Both algorithms give forward secrecy. https://www.imperialviolet.org/2011/11/22/forwardsecret.html

share|improve this answer
1  
Brilliant catch! +1 –  Adnan Jul 2 '13 at 20:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.