Skip to main content
  1. Home
  2. Computing
  3. News

Google bolsters encryption for Blogspot domain residents with HTTPS rollout

Kevin Parrish
By

made for google
Image used with permission by copyright holder
Google software engineer Milinda Perera said this week that the company is now rolling out an HTTPS version of every single blog stored away on the Blogspot domain. That means visitors can load up their favorite blog on this specific domain over an encrypted channel, preventing eavesdropping snoops from seeing what they’re actually accessing. Even more, there’s nothing to enable: all Blogspot domain residents automatically have the HTTPS version switched on.

But of course, there’s a catch. Blogs with mixed content may not work correctly on the HTTPS version. According to Perera, this is caused by several factors: post content, incompatible templates, or gadgets. To help authors weed out the problematic elements, Google is offering a mixed content warning tool to help fix the issues manually. Perera said that Google is proactively fixing most of the errors it comes across.

Recommended Videos

Another catch is that Blogspot posts published on custom domains currently do not have HTTPS support. For those who are unaware, Google bloggers can actually publish their content on a top-level domain (www.mydomain.com) or a subdomain (myblog.mydomain.com). This can be accomplished by clicking on “Basic” under the blog’s “Settings” tab, and then adding the custom domain address in the “Publishing” section. While supporting HTTPS is presumably possible, it may be some time before Google tackles this specific feature.

Related

Outside of those two setbacks, the HTTPS versions won’t screw up existing links and bookmarks stored on the blog entries. The company has also injected Blogspot with a new HTTPS Redirect setting that allows authors to provide access to either one version of the blog (on = HTTPS), or two versions of the blog (off = HTTPS and HTTP). Note that with the setting turned off, visitors will have access to the blog on an unencrypted connection.

So what’s the big deal about HTTPS? It’s an internet protocol that secures the connection between a device application (email app, browser, etc), and a website or service. This not only keeps data safe and secure from prying eyes as it speeds across the virtual highways, but protects the user’s privacy in the process. Websites with the vanilla HTTP protocol do not offer this type of security.

Google’s move to secure all Blogspot residents is part of the overall HTTPS Everywhere initiative. While there are many sites that offer HTTPS security, a good chunk of the internet does not. And as the Electronic Frontier Foundation (EFF) points out, many encrypted pages may still contain links that direct users back to the unencrypted version. Third-party content mayalso  not be encrypted through links on an HTTPS-based site.

To that end, the EFF teamed up with Google, Mozilla, and Opera to create an extension that encrypts the Internet surfer’s communications with a number of major websites. The extension is offered for the Chrome, Firefox, Firefox for Android, and Opera browsers.

Google started testing the HTTPS waters with the Blogspot domain back in September 2015 as an opt-in feature. The company actually began encrypting its services in 2008, securing Search, Gmail, Drive, and other services throughout the years. Google said that some of the benefits to HTTPS encryption include preventing visitors from being redirected to a malicious site, preventing changes to data exchanged between the Blogspot domain and the visitor, and so on.

That said, Google is now officially rolling out HTTPS encryption to all Blogspot residents, not just with volunteers, as seen in September. The company encourages its bloggers to provide feedback so that it can make improvements.

Editors' Recommendations

Topics
Kevin Parrish
Kevin Parrish
Former Digital Trends Contributor
Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…
Google acquires Typhoon Studios to bolster Stadia game development team
Journey to the Savage Planet by Typhoon Studios

Google acquired Typhoon Studios, the independent developer behind the upcoming Journey to the Savage Planet, to help make games for the Stadia streaming service.

In a blog post, Google said that Typhoon Studios will be joining the first studio of Stadia Games and Entertainment in Montreal. The developer, however, will continue working on the release of Journey to the Savage Planet to multiple platforms on January 28, 2020, as it is integrated into Stadia's game development team. Future games from Typhoon Studios will be exclusive to Stadia.

Read more
Update your Google Chrome browser now: New exploit could leave you open to hacks
Google Chrome Stock Photo

If you’re a Google Chrome user, you should update the browser immediately. Google released a software update to the browser late yesterday evening that patches two zero-day vulnerabilities to the browser that could potentially allow the browser to be hijacked by hackers.
One of the vulnerabilities affects Chrome’s audio component (CVE-2019-13720) while the other resides in the PDFium (CVE-2019-13721) library.
Hackers can corrupt or modify the data in Chrome’s memory using the exploit, which will eventually give them access to the computer as a whole.
One of the exploits, CVE-2019-13720 has been discovered in the wild by researchers at Kaspersky.
Google says that the update to the browser will be rolling out to users automatically over the coming days and weeks.
That said, if you’re a Chrome user it would be more prudent for you to go ahead and do that update manually right now instead.
To make it happen you’ll want to launch Chrome on your computer and then click on “Chrome” in the menu bar followed by “About Chrome.” That will launch the Settings menu. From there,  click “About Chrome” at the bottom of the menu on the left. That will likely trigger an automatic update if yours hasn’t already happened. If it doesn’t, you’ll see a button to manually update the browser as well.
Once you update the browser you should be good to go without fear of the security threat becoming an issue. Last month many Mac users ran into issues with Google Chrome when it seemed to send computers into an endless reboot cycle.
An investigation by Mac enterprise and IT blog Mr. Macintosh found that the issue was actually a bug that deletes the symlink at the/var path on the Mac it’s running on, which essentially deletes a key in the MacOS system file.
That issue only impacted Macs where the System Integrity Protection (SIP) had been disabled. The issue particularly impacted older Macs that were made before SIP was introduced with OS X El Capitan in 2015.
All this comes as Google is gearing up to launch some major updates to Chrome, including one update that will change how you manage tabs using the browser. That update is expected to roll out later this year.

Read more
1.5% of Chrome users’ passwords are known to be compromised, according to Google
A password screen with an indecipherable password inputted.

1.5% of passwords used in Chrome are unsafe and have been released in data breaches, according to new information from Google.

In February, a new feature was introduced to the Google Chrome browser which checks whether users' passwords are secure. Password Checkup is a free download that scans a database of 4 million compromised passwords and informs users if their password is among them and they need to change it. The database of passwords is collated from known third-party data breaches and when a user enters their password, it is checked against the list.

Read more