Engineering and Developers Blog
What's happening with engineering and developers at YouTube
YouTube's road to HTTPS
2016年8月1日星期一
Today we added YouTube to Google's
HTTPS transparency report
. We're proud to announce that in the last two years, we steadily rolled out encryption using HTTPS to 97 percent of YouTube's traffic.
HTTPS
provides critical security and data integrity for the web and for all web users. So what took us so long? As we gradually moved YouTube to HTTPS, we faced several unique challenges:
Lots of traffic!
Our CDN, the
Google Global Cache
, serves a massive amount of video, and migrating it all to HTTPS is no small feat. Luckily, hardware acceleration for AES is widespread, so we were able to encrypt virtually all video serving without adding machines. (Yes,
HTTPS is fast now
.)
Lots of devices!
You watch YouTube videos on everything from flip phones to smart TVs. We A/B tested HTTPS on every device to ensure that users would not be negatively impacted. We found that HTTPS improved quality of experience on most clients: by ensuring content integrity, we virtually eliminated many types of streaming errors.
Lots of requests!
Mixed content—any insecure request made in a secure context—poses a challenge for any large website or app. We get an alert when an insecure request is made from any of our clients and will block all mixed content using
Content Security Policy
on the web,
App Transport Security
on iOS, and uses
CleartextTraffic
on Android. Ads on YouTube have used HTTPS
since 2014
.
We're also proud to be using
HTTP Secure Transport Security (HSTS)
on youtube.com to cut down on HTTP to HTTPS redirects. This improves both security and latency for end users. Our HSTS lifetime is one year, and we hope to preload this soon in web browsers.
97 percent is pretty good, but why isn't YouTube at 100 percent? In short, some devices do not fully support modern HTTPS. Over time, to keep YouTube users as safe as possible, we will gradually phase out insecure connections.
In the real world, we know that any non-secure HTTP traffic could be vulnerable to attackers. All websites and apps should be protected with HTTPS — if you’re a developer that hasn’t yet migrated,
get started
today.
Sean Watson, Software Engineer, recently watched "
GoPro: Fire Vortex Cannon with the Backyard Scientist
."
Jon Levine, Product Manager, recently watched "
Sega Saturn CD - Cracked after 20 years
."
标签
.net
360
acceleration
access control
accessibility
actionscript
activities
activity
android
announcements
apis
app engine
appengine
apps script
as2
as3
atom
authentication
authorization
authsub
best practices
blackops
blur faces
bootcamp
captions
categories
channels
charts
chrome
chromeless
client library
clientlibraries
clientlogin
code
color
comments
compositing
create
curation
custom player
decommission
default
deprecation
devs
direct
discovery
docs
Documentation RSS
dotnet
education
embed
embedding
events
extension
feeds
flash
format
friendactivity
friends
fun
gears
google developers live
google group
googlegamedev
googleio
html5
https
iframe
insight
io12
io2011
ios
iphone
irc
issue tracker
java
javascript
json
json-c
jsonc
knight
legacy
Live Streaming API
LiveBroadcasts API
logo
machine learning
mashups
media:keywords keywords tags metadata
metadata
mobile
mozilla
NAB 2016
news
oauth
oauth2
office hours
open source
partial
partial response
partial update
partners
patch
php
player
playlists
policy
previews
pubsubhubbub
push
python
quota
rails
releases
rendering
reports
responses
resumable
ruby
samples
sandbox
shortform
ssl https certificate staging stage
stack overflow
stage video
staging
standard feeds
storify
storyful
subscription
sup
Super Chat API
survey
tdd
theme
tos
tutorials
updates
uploads
v2
v3
video
video files
video transcoding
virtual reality
voting
VR
watch history
watchlater
webvtt
youtube
youtube api
YouTube Data API
youtube developers live
youtube direct
YouTube Engineering & Developers Blog
YouTube IFrame Player API
YouTube live
YouTube Reporting API
ytd
Archive
2020
十一月
2019
八月
四月
2018
十二月
八月
四月
2017
十一月
九月
八月
三月
一月
2016
十一月
十月
八月
五月
四月
2015
十二月
十一月
十月
五月
四月
三月
一月
2014
十月
九月
八月
五月
三月
2013
十二月
十月
九月
八月
七月
六月
五月
四月
三月
二月
2012
十二月
十一月
九月
八月
七月
六月
五月
四月
三月
二月
一月
2011
十二月
十月
九月
八月
七月
六月
五月
四月
三月
二月
一月
2010
十二月
十一月
十月
九月
七月
六月
五月
四月
三月
二月
一月
2009
十一月
十月
九月
八月
七月
六月
五月
四月
三月
二月
一月
2008
十二月
十一月
十月
九月
八月
七月
六月
五月
四月
三月
二月
2007
十二月
十一月
八月
六月
五月
Feed
Follow @youtubedev
