Google makes YouTube safer to navigate thanks to a massive amount of work to support technologies like HTTPS and HSTS

Aug 3, 2016 14:02 GMT  ·  By

In March, Google added an HTTPS usage section to its Transparency Report for the first time, providing some insight on how the company uses HTTPS across its services.

Absent from that initial report was YouTube, one of the company's top 3 services, next to its search engine and Gmail.

This data has now been added to Google's Q2 Transparency Report, and according to Google's statistics, 97 percent of all YouTube users are visiting the site via HTTPS, with only a few technically challenged users still using the website's HTTP version.

It took Google two years to move YouTube to HTTPS

Google says this is the result of a two-year push from the YouTube staff to enforce HTTPS connections by default. The team revealed that they had gone over several hurdles to get this done.

This includes migrating all YouTube videos stored in the Google CDN (named the Google Global Cache) to HTTPS.

"[T]he Google Global Cache, serves a massive amount of video, and migrating it all to HTTPS is no small feat," Google's Emily Schechter explains. "Luckily, hardware acceleration for AES is widespread, so we were able to encrypt virtually all video serving without adding machines."

Additionally, the team also had to deal with the plethora of devices the service had to support, along with mixed content loaded on the site from insecure HTTP URLs, which also had to be migrated to HTTPS.

The first step was to migrate all of YouTube's ads to HTTPS, which Google said it finished in 2014, in the early phase of moving YouTube to HTTPS.

YouTube supports HSTS - HTTP Strict Transport Security

A few days ago, Google also announced HSTS support for all the Google services running on the google.com domain. The same is also true for YouTube, which also received HSTS support.

HSTS stands for HTTP Strict Transport Security and is a Web security protocol supported by all of today's browsers and Web servers. The technology allows webmasters to protect their service and their users from HTTPS downgrades, man-in-the-middle attacks, and cookie hijacking for HTTPS connections.

Currently, only 5 percent of all HTTPS servers also support HSTS, according to a recent Netcraft study.

YouTube HTTPS traffic: 97%
YouTube HTTPS traffic: 97%

Photo Gallery (2 Images)

Google says 97% of all YouTube traffic is via HTTPS
YouTube HTTPS traffic: 97%
Open gallery