Google says 77% of its traffic is encrypted

For years, Internet giants, including Google and Facebook, have warned about the importance of using HTTPS, a secure Internet protocol that encrypts your traffic and makes it a lot harder for anyone to eavesdrop on your communications. 

So where do we stand on the HTTPS front in 2016? According to a new, HTTPS-focused section of Google's Transparency Report, first published on Tuesday, Google itself is doing pretty good. Around 77% of requests to Google's servers are currently encrypted, up from 50% in January 2014 -- although it's worth noting that these figures do not include YouTube traffic.

Google's arguably most important service, Gmail, is 100% encrypted, as is Google Drive -- not a surprise since Gmail is HTTPS-only since March 2014. Maps, Finance, News and Advertising are all above 50%, with the last two showing a huge increase in the last two years. 

Original image has been replaced. Credit: Mashable

Google says it's working to bring all these numbers to 100%, but it's not always simple. "We continue to work through the technical barriers that make it more difficult to support encryption on some of our products," says Google in its Transparency Report.  

One of these technical barriers are old mobile devices, which simply don't support modern encryption standards. According to Google's numbers, 95.5% of unencrypted, end user traffic to Google services which are a part of this survey comes from old mobile devices. 

Another important obstacle is deliberate blocking or degrading of HTTPS traffic by "certain countries and organizations." 

Original image has been replaced. Credit: Mashable

Google's report also includes data on other top Internet sites. And while some of the largest sites out there, including Facebook, Instagram, Paypal, Reddit, Pinterest, Tumblr, Twitter, WhatsApp, Wikipedia and WordPress, have HTTPS turned on by default, there are many top destinations that support HTTPS but don't run it by default, including Amazon and Imgur. 

The worst offenders are popular sites that don't support HTTPS at all, or don't offer modern versions of the protocol (which Google defines as TLS v1.2 with a cipher suite that uses an AEAD mode of operation).

There are a lot of names on this list that shouldn't be here; including huge commerce sites like Alibaba and Aliexpress, networks such as CNN and BBC, and large media outlets such as The Guardian and The New York Times.

Embarrassingly, Microsoft, eBay, Yelp and Apple only support older versions of HTTPS, and don't run it by default. 

Finally, a number of well-known pornographic sites, including Pornhub, Redtube and Youporn, don't support HTTPS at all. 

Check out Google's entire HTTPS report here.

Have something to add to this story? Share it in the comments.