Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it there any difference between the encrypted Google search (at and the ordinary HTTPS Google search (at

In terms of security what were the benefits of browsing through encrypted Google search?

Note that this is not a question about HTTP vs HTTPS. These are two Google services.

share|improve this question
This is about vs, not http and https. – Henning Klevjer Mar 10 '13 at 15:21
There's no top navigation bar in encrypted. – John Isaiah Carmona Mar 11 '13 at 9:35
@John Whoa. I’ve made this my default search engine now. I don’t care about referrers (I’ve disabled them anyway) but the missing top bar is a killer feature. – Konrad Rudolph Mar 11 '13 at 10:51
@Luc It may be useful but it’s also a crass invasion of the user’s privacy. A website generally has no business knowing how I get there. I agree that it’s useful for the website to know but only in rare instances does the user profit from that. – Konrad Rudolph Jul 2 '13 at 20:55
@KonradRudolph As an example, yesterday I looked at the referring sites from a website I maintain and found some things I hadn't expected people to search for. Knowing those (one example search was "harbor roermond", in Dutch) we can optimize the website so that we can be found more easily; we weren't the top hit while some above us were useless linkspam. I myself never did it, but even if this was only to make money, then even in that case the user might profit from it. But this could become a very long discussion. Feel free to ping me in the DMZ or another room if you want to discuss it ;) – Luc Jul 2 '13 at 21:02
up vote 143 down vote accepted

According to Google, the difference is with handling referrer information when clicking on an ad.

After a note from AviD and with the help of Xander we conducted some tests and here are the results

1. Clicking on an ad:

  • : Google will take you to an HTTP redirection page where they'd append your search query to the referrer information.

  • : If the advertiser uses HTTP, Google will not let the advertiser know about your query. If the advertiser uses HTTPS, they will receive the referrer information normally (including your search query).

2. Clicking on a normal search result:

  • : If the website uses HTTP, Google will take you to an HTTP redirection page and will not append your search query to the referrer information. They'll only tell the website that you're coming from Google. If it uses HTTPS, it will receive referrer information normally.

  • : If the website you click in the results uses HTTP, it will have no idea where you're coming from or what your search query is. If it uses HTTPS, it will receive referrer information normally.

The same topic was covered in an EFF blog post.

share|improve this answer
One benefit of this: copying a link from a Google search result will give you a link to a webpage, not the jumbled mess of a redirect link. – Evan Teitelman Jul 2 '13 at 18:05
@EvanTeitelman The link becomes a redirect when I click on it. – curiousguy Sep 20 '13 at 18:13
@Adnan, So this is all? I mean, they built just to do that referrer thing? – Pacerier Jun 9 '14 at 22:01
@EvanTeitelman, No it doesn't work, try it. – Pacerier Jun 9 '14 at 22:05
@Pacerier Originally, no. The encrypted. domain was where Google first rolled SSL support. However, after they added SSL support to the main domain, that became the distinction. – Adi Jun 10 '14 at 7:01

At the time of writing (July 2013), the two sites have different preferences for key exchange algorithms. To inspect in Chrome, click the padlock icon and select the 'connection' tab.

Against Chrome 28, vanilla uses ECDHE_RSA, uses ECDHE_ECDSA. Both algorithms give forward secrecy.

For details, compare the configurations using the SSL Labs server test

share|improve this answer
Brilliant catch! +1 – Adi Jul 2 '13 at 20:10
This answer is no longer correct. Now both use ECDHE_ECDSA. See, e.g.,…. – D.W. Jun 16 at 23:12

protected by Community Nov 11 '14 at 11:14

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.