Hacker News new | ask | show | jobs
by simonbrown 5354 days ago
If referrers from HTTPS pages were sent to HTTP pages by browsers anyone sniffing the connection would know the URL the user visited. For a search engine, this would make SSL pretty useless as the main thing worth encrypting is search queries and people usually end up clicking links to non-SSL pages.

I presume they're working around it for ads and (telling webmasters the user is coming from Google) by sending the user through a HTTP page before they reach the result (like DuckDuckGo does, but for the opposite reason).