Two thirds of internet radio still is not secure — here is what we do about it

Before writing any of this website, we measured a thousand of the most-listened stations to find out how many a secure page could actually play. The answer was worse than expected: only 33.6% offered a secure stream. Two thirds broadcast over plain HTTP, which browsers block on a secure site — silently, with no error a page can catch.

Filtering was not an option

The obvious fix is to hide the stations that will not play. We ruled it out once we looked at where the losses fell. Italy would have lost 87% of its stations, France 84%, the United Kingdom 79%. No country in our sample cleared 66%. That is not a smaller catalogue, it is a broken product for anyone outside a handful of markets.

Relaying, but only where it is needed

Instead, stations that only offer plain HTTP are relayed through our servers, which lets a secure page play them. Relaying costs real bandwidth, so we do as little of it as possible.

It turns out many stations are reachable securely even though the directory does not say so. When you press play, we check — and if the station answers securely on its own, we hand you straight to it rather than relaying. That covers roughly a third of the stations that would otherwise need help, and those listeners get a faster, more direct connection as a side effect.

What you might notice

Occasionally a station takes a moment longer to start. That is the check happening. Station pages say whether playback is direct or relayed, because we would rather explain it than have it look like magic.