Youtube now supports HTTPS

Discussion in 'other security issues & news' started by TairikuOkami, Feb 27, 2011.

Thread Status:
Not open for further replies.
  1. TairikuOkami

    TairikuOkami Registered Member

    Joined:
    Oct 10, 2005
    Posts:
    2,509
    Location:
    Slovakia
  2. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    @ TOMxEU

    Thanks for the heads up :thumb:

    I noticed that HTTPS Everywhere listed it as buggy.

    yt.gif

    Maybe it's OK now ?
     
  3. TairikuOkami

    TairikuOkami Registered Member

    Joined:
    Oct 10, 2005
    Posts:
    2,509
    Location:
    Slovakia
    I have just read an article (not in english), that Google now fully supports HTTPS, you can also upload videos in HTTPS.
     
  4. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    @ TOMxEU

    OK thanks :thumb:
     
  5. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,856
    Working good, would this defeat some ISP's throttling tactics I wonder?
     
  6. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    It actually contains mixed content - https and http.
     
  7. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,856
    That's most likely the adverts, it actually works in your favour. Some browsers block unsecure content by default, so it's pretty much blocking the ads for you.
     
  8. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Actually, it's for:

    -http://youtube-global.blogspot.com (and other sub-domains)
    -http://code.google.com/etc...
    -http://www.google.com/etc...

    I don't know about the ads... I can't see any. ;)

    I access YouTube with a dedicated Chromium profile only allowing connections to *.youtube.com and *.ytimg.com.

    -edit-

    I missed some:

    -http://gdata.youtube.com/feeds/base/etc...
    -http://www.youtube.com/etc...

    Well, according to the source code there are 20 http connections. Some may be repeated, though.
     
    Last edited: Feb 27, 2011
  9. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
  10. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,856
    If that was true, when I browse to youtube with https the video would simply not load, because IE9 doesn't load unsecure content unless you allow it. Yet it does load, so the video is coming from a secure source.
     
  11. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Then, if you block access in your firewall to port 80 for process iexplore.exe, videos should still load. Could you try it?

    As I explained in the other thread, my firewall was only allowing my Chromium Youtube profile to access protocol https. Videos wouldn't play. Allowing communication to protocol http allowed the videos to play. So, http is clearly involved here.
     
  12. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,856
    You're assuming the video came from the youtube domain or used a specific port?
     
  13. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    I'm assuming it used port 80. Only allowing access to port 443 (https) will result in videos not playing. It appears the error message An error has occurred, please try again later.

    Allow communication to port 80, will result in the videos playing.
     
  14. Sadeghi85

    Sadeghi85 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    747
    I confirm m00nbl00d's finding.

    (red line)
    YT.PNG
     
  15. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,856
    Seems you're right, from what I can see, the unsecure video is fetched from a secure script.

    load.png

    The entire thing is pointless then.
     
  16. LODBROK

    LODBROK Guest

    Wow. Https for yoo toob. The cesspool gets encrypted. :cautious:
     
  17. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Momentary lapse from Google? :rolleyes:
     
  18. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,856
    It's probably more that they don't care enough. Hence why they haven't made any official announcement about it or made an effort to stop the unsecure content being shown when using https.
     
  19. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,516
    Why the animosity over HTTP videos?

    Your account is HTTPS encrypted, as well as most other parts of YouTube. That's good enough for privacy.

    I think those videos need to be HTTP in order to be cached.
     
  20. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Why would Google provide Youtube in protocol https, in the first place? It makes no sense, at all.

    As you well said, access to Youtube account is encrypted. All I can think of is that, Google wanted to give users privacy... but the question is: What privacy? -https://www.youtube.com also has http content, including the fetched videos.

    What exactly was Google's aim? Entertainment to the mob? :ninja:
     
  21. Boost

    Boost Registered Member

    Joined:
    Feb 2, 2007
    Posts:
    1,293
    No problems using youtube here! :thumb:
     
  22. chronomatic

    chronomatic Registered Member

    Joined:
    Apr 9, 2009
    Posts:
    1,343
    To encrypt your account logins, I assume.
     
  23. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,856
    I think Boost and Mr. PC missed the point of this thread *puppy*

    Account logins are done on a secure Google page, so no, that would not be the reason. It's simply a flawed implementation.
     
  24. PJC

    PJC Very Frequent Poster

    Joined:
    Feb 17, 2010
    Posts:
    2,959
    Location:
    Internet
    Chill out, "dude"...
    BTW, my Name is Mr.PC;not Mr. PC *puppy*
     
    Last edited: Apr 9, 2011
  25. Boost

    Boost Registered Member

    Joined:
    Feb 2, 2007
    Posts:
    1,293
    Nope, I use my PC for what it was made for,not trying to figure this out and then this or that.
     
Loading...
Thread Status:
Not open for further replies.