On Friday, Google's security team announced that it has completed implementing HSTS support for all of the company's products running on the google.com domain.
This move comes after months of testing to confirm that the feature covers all services, including APIs, and not just the main Web interfaces.
HSTS stands for HTTP Strict Transport Security and is a Web security protocol supported by all modern browsers and Web servers.
This technology allows webmasters to protect their service and users from HTTPS downgrades, man-in-the-middle attacks, and cookie hijacking for HTTPS connections.
The protocol prevents users from going back to an HTTP connection when accessing Google over HTTPS and "forcefully" redirects users to HTTPS connections as much as possible.
The technology is widely considered the best way to protect HTTPS connections from the most common SSL attacks, but it has not been widely adopted.
A study by Netcraft conducted last March showed that 95% of all servers running HTTPS either fail to install HSTS or encounter configuration errors. As a result, the Google team has spent a lot of time testing.
“Normally, implementing HSTS is a relatively basic process,” Google’s Jay Brown, Senior Technical Program Manager, explained Friday. “However, due to Google’s particular complexity, we had to do some extra preparation that most other domains wouldn’t have to do. For example, we had to deal with mixed content, broken links, HTTP redirects, and other issues like updating legacy services that could cause problems for users trying to access our main domain.”
During HSTS testing, Brown says the team managed to break Google's famous Santa Tracker last December. The problem was fixed, but that just goes to show the wide range of products engineers had to ensure worked properly after HSTS was implemented.
