After google started using https for signed-in users, Google Analytics started showing "(not proviced)" as the keyword when a user enters a site via https organic search. For example:
Given that the referrer is not available when a user is using HTTPS, how would Gooogle Analytics be able to tell that an HTTPS user came from a search engine?
The targets of Google results are intermediates page that redirect to the desired URL like :
http://www.google.com/url?sa=t&rct=j&q=yahoo&esrc=s&source=web&cd=1&sqi=2&ved=0CDEQFjAA&url=http%3A%2F%2Fwww.yahoo.com%2F&ei=sOuaT6qMEaW80QWw8JjuDg&usg=AFQjCNG7Ba-stir4109vlLygPQX7QGf8bg
When you use Google with https, results targets the same URL but an empty q parameter :
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&sqi=2&ved=0CDEQFjAA&url=http%3A%2F%2Fwww.yahoo.com%2F&ei=sOuaT6qMEaW80QWw8JjuDg&usg=AFQjCNG7Ba-stir4109vlLygPQX7QGf8bg
So there is a http refferer but without any keyword information.
Google deceive you into thinking that the target for what you click on is the URL you see when hovering over a link (presumably by altering the status bar with JavaScript).
If you right-click and copy the link (for example, depending on your browser), you'll see that each link you click on from a Google search first goes through a Google server, with various parameters in the query, that presumably help it tie it back the the search keywords that you've used. (It's not clear whether this would work with other search engines.)
