> My guess is someone at Google read an outdated, incorrect blog post about the BEAST attack and saw the recommendation to force RC4. They then did so without

> My guess is someone at Google read an outdated, incorrect blog post about the BEAST attack and saw the recommendation to force RC4. They then did so without bothering to learn anything about what they were doing. Oh, well, no. Really, this is not something that can happen at Google. The security people working there are for sure not clueless and a similar decision is not taken so lightly at that scale. What happened is that they looked into it more than OP, benchmarked it and decided that the performance overhead of a cipher different from RC4 was not acceptable for the video streams. Or they have hardware streaming those videos that only supports RC4. It's not small play as OP seems to believe. I'm actually amazed that they enabled AES-GCM as a fallback. Btw, RC4 remaining preferred points more in the direction of performance reasons.