Securing GMail

[slowfox]

You've probably known this for a long while, but since I've only just got around to doing it, I thought I'd mention...

As this Wired article explains, although gMail asks for your initial log on password via HTTPS (the nice, secure protocol), the rest of your session, under the default settings, is plain HTTP. Which is potentially a problem if you're checking email from a WiFi hotspot or whatever.

Changing this is easy enough, once you know where to look.

Go to Settings (upper right hand side of the screen), and from there you should be on the 'General' tab.

Right at the bottom of the page is a section headed 'Browser Connection', and, as above, the default is 'Don't always use HTTPS'. I've changed my settings to 'always use https', and haven't (yet) noticed any drawbacks.

Now, because HTTPS is encrypted, it does mean that encryption/decryption has to take place at both the client (your machine) and the server (Google's kit), so, in theory, using HTTPS all the time will slow things down a bit.

On the other hand, not using HTTPS means that the communication twixt you and Google's cloud is all in the clear, and is much easier to eavesdrop/snoop on. Especially since a tool was announced at DEFCON last year which made such snooping 'relatively easy'.

So, the general advice (from Wired, above, The Register, here, Mashable, here and the good old Beeb, here) is to always use HTTPS.

Comments

[estel]

Thanks, I did not know about this.

However, I usually use gmail from my mail client. I'm guessing that might still be going unencrypted.

[slowfox]

I've noticed the option a couple of times, and always meant to check it. Now I finally have: you'd have thought that they might've made this the default choice, and allow people to opt out if they encountered problems, rather than the behaviour being the other way 'round...

... I'm pretty sure than in years to come, people are going to be horrified about how much of our internet activity was conducted unencrypted Back In The Day...

[anotherpenguin]

I had no idea, so thanks !

Although, when I checked, none of the radio buttons were actually default-checked. Weird.

[slowfox]

Well, since the standard inbox screen, once you were past the login, used HTTP, I'm assuming that although neither button was actually checked, it certainly wasn't using HTTPS for the session.

An odd choice, but one done, presumably for reasons of performance (possibly at their end? I mean, if you've got millions of users all connecting, that's going to have some performance hit, I'd have thought, even if the client end, only having one SSL to maintain, isn't really going to suffer too much increased workload).

[alicit]

I have been using the "always use https" option for years and haven't had any trouble with it.

[slowfox]

I've not experienced any trouble, either - I'm assuming that Google have the option to opt out of this in case, somewhere, it causes someone issues. Still think that the most secure mechanism ought to be the default, though...

[aome]

You need to add "PSA" to your tags. :D

[slowfox]

:D

Just trying to share the bits and pieces I pick up. This is, unfortunately, having the side-effect of me becoming increasingly paranoid about what's on the web, and how safe it all is...