All you watch on YouTube can be tracked

Hackers, intelligence agencies and advertisers could be tracking your online video-watching habits, even when the sites in question, such as YouTube, provide encryption and promise anonymity, according to research by a Ben Gurion University cyber-security expert, who presented the research at a recent Black Hat Europe cyber-security gathering in London.

Gaps in YouTube's encryption enable both government intelligence agencies, hackers and internet marketers to determine which videos a user is watching, said the researchers.

"We built a simple yet robust machine-learning algorithm that can identify which video you watched — within a predetermined set of videos — with a high degree of accuracy," said one of the researchers Ran Dubin from Ben-Gurion University of the Negev (BGU) in Israel.

"The algorithm is based on an in-depth study of how video services work, how video content is encoded and how a video player requests information to play it," Mr Dubin said.

Mr Dubin was able to use this machine-learning algorithm to determine if someone had watched a specific video from a set of suspicious and terror-related videos. 

The vulnerability is unlikely to be fixed, he said. “Google, YouTube’s parent company, is not likely to patch the gaps, since it would be prohibitively expensive to create a traffic obfuscation mechanism for every user’s every video request.” "It's important to know that video encryption is not as secure as we once thought," Dubin underlined.

Researchers are exploring an upside to this discovery: the ability to assess video quality without breaking an encryption. "While internet service providers want to ensure they are providing high quality streaming, encryption has made accessing information much more challenging," says Dubin. "This tracking algorithm could help."