I haven't noticed until now that Google Analytics happens to be one of the last Google products that isn't using SSL by default.
Over the past few years, Google have moved closer and closer towards implementing SSL on all their products. In January 2010, Gmail became HTTPS by default. In October 2011, Google Search became HTTPS by default. In September 2013, Google AdSense added support for serving through HTTPS.
In December 2013, it was discovered that the NSA uses Google cookies to pinpoint targets for hacking. This is only made possible due to Google Analytics not using HTTPS. More worryingly, the heavy usage of Google Analytics means that most of your web browsing habits can be easily intercepted.
Whats the deal Google? Why is it taking so long to lock down GA?