youtube search engine in search bar is not https

Discussion in 'privacy technology' started by febainy, Aug 17, 2014.

Thread Status:
Not open for further replies.
  1. febainy

    febainy Registered Member

    Joined:
    Feb 11, 2014
    Posts:
    48
    I added youtube search to Firefox search bar long ago, recently I discover the xml file (/home/febainy/.mozilla/firefox/??/searchplugins/youtube-video-search.xml) which store youtube search engine, this text only contains the phrase http, not https. No matter you add the youtube search engine from its https or http site.
     
  2. JRViejo

    JRViejo Global Moderator

    Joined:
    Jul 9, 2008
    Posts:
    20,956
    Location:
    U.S.A.
  3. blainefry

    blainefry Registered Member

    Joined:
    Jan 25, 2014
    Posts:
    165
  4. guest

    guest Guest

  5. TairikuOkami

    TairikuOkami Registered Member

    Joined:
    Oct 10, 2005
    Posts:
    2,509
    Location:
    Slovakia
    I have just found out, that I have used http only, but it switched to https everytime, since my youtube account uses it by default. Does yours?
    Alternatively you can just add search to FF with SSL yourself, usually something like: https://www.youtube.com/results?search_query={s}
     
  6. guest

    guest Guest

    It doesn't work. At least not for me. It will be switched back to normal HTTP somehow.
     
  7. TairikuOkami

    TairikuOkami Registered Member

    Joined:
    Oct 10, 2005
    Posts:
    2,509
    Location:
    Slovakia
    Interesting, there was an option to switch to SSL, I have used it some time ago, I guess, they have removed it, probably to decrease the load on their servers.
     
  8. JRViejo

    JRViejo Global Moderator

    Joined:
    Jul 9, 2008
    Posts:
    20,956
    Location:
    U.S.A.
    FYI. In Firefox, you can make it so by using the YouTube (SSL) Add-on.
     
  9. jnthn

    jnthn Registered Member

    Joined:
    Sep 22, 2010
    Posts:
    185
    Why not just edit the xml file and change http to https? Seems to work fine on my end. I do have HTTPS Everywhere also installed.
     
  10. guest

    guest Guest

    Is that official by YouTube/Google? If not, I'm sorry for being the most sceptical creature in the universe. But anyway, thanks for the info.

    Have you tried to disable HTTPS Everywhere?
     
  11. shuverisan

    shuverisan Registered Member

    Joined:
    Dec 23, 2011
    Posts:
    185
    No need to rely on what's in the addon store. Just make your own with only the necessary parts. Paste this into youtube.xml, then go to Preferences, Advanced, Update and uncheck Search Engines so it's not overwritten.

    Code:
    <?xml version="1.0" encoding="UTF-8"?>
    <OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/">
      <ShortName>Youtube</ShortName>
      <Description>Search Youtube</Description>
      <Image height="16" width="16" type="image/x-icon">https://youtube.com/favicon.ico</Image>
      <Url type="text/html" method="GET" template="https://www.youtube.com/results?search_query={searchTerms}"/>
    </OpenSearchDescription>
    From here:
    http://www.thesimplecomputer.info/search-engines-for-almost-everyone
     
  12. JRViejo

    JRViejo Global Moderator

    Joined:
    Jul 9, 2008
    Posts:
    20,956
    Location:
    U.S.A.
    No, it's not by YouTube/Google, it's from SSL Search Bar. I'm comfortable with a developer with almost 4 years track record, but then, different strokes for different folks. You're welcome. Take care.
     
  13. jnthn

    jnthn Registered Member

    Joined:
    Sep 22, 2010
    Posts:
    185
    I disabled all addons and did a youtube search after restarting the browser and as far as I can tell, relevant connections to youtube are encrypted except for DNS queries and OCSP transactions.
     

    Attached Files:

  14. guest

    guest Guest

    Thanks for the clarification. Maybe the culprit is on my end. :doubt:
     
  15. KeyPer4Life

    KeyPer4Life Registered Member

    Joined:
    Dec 18, 2013
    Posts:
    974
    Secure Connection Failed https://www.youtube.com/

    An error occurred during a connection to www.youtube.com.

    The OCSP server experienced an internal error.

    (Error code: sec_error_ocsp_server_error)
     
  16. guest

    guest Guest

    Alternatively NoScript can enforce HTTPS. Go to Advanced tab --> HTTPS tab --> Behavior tab --> Force the following sites to use secure (HTTPS) connections, then add www.youtube.com to the list. It works for me (remember that base 2nd level domain format doesn't seem to be supported, so simply adding youtube.com won't work).
     
  17. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    Or try adding .youtube.com
     
  18. guest

    guest Guest

    Thanks. Didn't know it can be done that way.
     
  19. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    You're welcome :).

    It's not intuitive.
     
  20. KeyPer4Life

    KeyPer4Life Registered Member

    Joined:
    Dec 18, 2013
    Posts:
    974
    Adding youtube to "NoScripts" - Force the following sites to use secure (HTTPS) connections
    results in secure connection failed.

    It has to do with the browser certificate validation settings.

    [√] When an OCSP server connection fails, treat the certificate as invalid

    When checked you get an OCSP server internal error when trying to connect to (HTTPS) youtube.
    Left unchecked and your able to securely connect to youtube, but is this a good idea?
     
  21. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
  22. guest

    guest Guest

    Thanks for the info, I'll enable it and hope there won't be problems. So this setting is pretty much like Chrome's "check for server's certificate revocation" thing, am I correct?

    EDIT: I enabled it and I got no problems when accessing YouTube in HTTPS.
     
    Last edited by a moderator: Aug 23, 2014
  23. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    You're welcome :).

    No, that setting is for "hard fail" (checked) vs "soft fail" (unchecked) OCSP. See https://scotthelme.co.uk/certificate-revocation-google-chrome/ for more details.
     
  24. KeyPer4Life

    KeyPer4Life Registered Member

    Joined:
    Dec 18, 2013
    Posts:
    974

    Thanks MrBrian that's what I thought and now how to solve the problem of connecting to (HTTPS)
    youtube. Any ideas without compromising security and leaving OCSP server connection fails checked
    in browser?
     
  25. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
Loading...
Thread Status:
Not open for further replies.