Google Online Security Blog: August 2014

Security Blog

The latest news and insights from Google on security and safety on the Internet

That’s not the download you’re looking for...

14. August 2014

Cross-posted on the Chrome Blog
Safe Browsing

these tips

Posted by Moheeb Abu Rajab, Staff Engineer, Google Security

Protecting Gmail in a global world

12. August 2014

Last week we announced support for non-Latin characters in Gmail—think δοκιμή and 测试 and みんな—as a first step towards more global email. We’re really excited about these new capabilities. We also want to ensure they aren’t abused by spammers or scammers trying to send misleading or harmful messages.
Scammers can exploit the fact that ဝ, ૦, and ο look nearly identical to the letter o, and by mixing and matching them, they can hoodwink unsuspecting victims.* Can you imagine the risk of clicking “ShဝppingSite” vs. “ShoppingSite” or “MyBank” vs. “MyBɑnk”?

To stay one step ahead of spammers, the Unicode community has identified suspicious combinations of letters that could be misleading, and Gmail will now begin rejecting email with such combinations. We’re using an open standard—the Unicode Consortium’s “Highly Restricted” specification—which we believe strikes a healthy balance between legitimate uses of these new domains and those likely to be abused.
We’re rolling out the changes today, and hope that others across the industry will follow suit. Together, we can help ensure that international domains continue to flourish, allowing both users and businesses to have a tête-à-tête in the language of their choosing.

Posted by Mark Risher, Spam & Abuse Team

*For those playing at home, that's a Myanmar letter Wa (U+101D), a Gujarati digit zero (U+AE6) and a Greek small letter omicron (U+03BF), followed by the ASCII letter 'o'.

HTTPS as a ranking signal

6. August 2014

Cross-posted from the Webmaster Central Blog

Security is a top priority for Google. We invest a lot in making sure that our services use industry-leading security, like strong HTTPS encryption by default. That means that people using Search, Gmail and Drive, for example, automatically have a secure connection to Google.

Beyond our own stuff, we’re also working to make the Internet safer more broadly. A big part of that is making sure that websites people access from Google are secure. For instance, we have created resources to help webmasters prevent and fix security breaches on their sites.
We want to go even further. At Google I/O a few months ago, we called for “HTTPS everywhere” on the web.
We’ve also seen more and more webmasters adopting HTTPS (also known as HTTP over TLS, or Transport Layer Security), on their website, which is encouraging.
For these reasons, over the past few months we’ve been running tests taking into account whether sites use secure, encrypted connections as a signal in our search ranking algorithms. We’ve seen positive results, so we’re starting to use HTTPS as a ranking signal. For now it's only a very lightweight signal—affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content—while we give webmasters time to switch to HTTPS. But over time, we may decide to strengthen it, because we’d like to encourage all website owners to switch from HTTP to HTTPS to keep everyone safe on the web.
In the coming weeks, we’ll publish detailed best practices (we’ll add a link to it from here) to make TLS adoption easier, and to avoid common mistakes. Here are some basic tips to get started:

Decide the kind of certificate you need: single, multi-domain, or wildcard certificate
Use 2048-bit key certificates
Use relative URLs for resources that reside on the same secure domain
Use protocol relative URLs for all other domains
Check out our Site move article for more guidelines on how to change your website’s address
Don’t block your HTTPS site from crawling using robots.txt
Allow indexing of your pages by search engines where possible. Avoid the noindex robots meta tag

If your website is already serving on HTTPS, you can test its security level and configuration with the Qualys Lab tool. If you are concerned about TLS and your site’s performance, have a look at Is TLS fast yet?. And of course, if you have any questions or concerns, please feel free to post in our Webmaster Help Forums.
We hope to see more websites using HTTPS in the future. Let’s all make the web more secure!

Posted by Zineb Ait Bahajji and Gary Illyes, Webmaster Trends Analysts

Labels

#sharethemicincyber
android
android security
android tr
app security
big data
biometrics
blackhat
chrome
chrome security
diversity
federated learning
fuzzing
Gboard
google play
google play protect
Open Source
pha family highlights
privacy
Security
spyware
targeted spyware
vulnerabilities

Archive

2021
- Apr
- Mär
- Feb
- Jan

2020
- Dez
- Nov
- Okt
- Sep
- Aug
- Jul
- Jun
- Mai
- Apr
- Mär
- Feb
- Jan

2019
- Dez
- Nov
- Okt
- Sep
- Aug
- Jul
- Jun
- Mai
- Apr
- Mär
- Feb
- Jan

2018
- Dez
- Nov
- Okt
- Sep
- Aug
- Jul
- Jun
- Mai
- Apr
- Mär
- Feb
- Jan

2017
- Dez
- Nov
- Okt
- Sep
- Jul
- Jun
- Mai
- Apr
- Mär
- Feb
- Jan

2016
- Dez
- Nov
- Okt
- Sep
- Aug
- Jul
- Jun
- Mai
- Apr
- Mär
- Feb
- Jan

2015
- Dez
- Nov
- Okt
- Sep
- Aug
- Jul
- Jun
- Mai
- Apr
- Mär
- Feb
- Jan

2014
- Dez
- Nov
- Okt
- Sep
- Aug
- Jul
- Jun
- Apr
- Mär
- Feb
- Jan

2013
- Dez
- Nov
- Okt
- Aug
- Jun
- Mai
- Apr
- Mär
- Feb
- Jan

2012
- Dez
- Sep
- Aug
- Jun
- Mai
- Apr
- Mär
- Feb
- Jan

2011
- Dez
- Nov
- Okt
- Sep
- Aug
- Jul
- Jun
- Mai
- Apr
- Mär
- Feb

2010
- Nov
- Okt
- Sep
- Aug
- Jul
- Mai
- Apr
- Mär

2009
- Nov
- Okt
- Aug
- Jul
- Jun
- Mär

2008
- Dez
- Nov
- Okt
- Aug
- Jul
- Mai
- Feb

2007
- Nov
- Okt
- Sep
- Jul
- Jun
- Mai

Feed

Give us feedback in our Product Forums.

Google
Privacy
Terms