PSA: Switch your gmail over to SSL

[ViviTheMage]

done

 

[waggy]

OH noo! someone might find out i need a dick enlarger!

my gmail is full of spam. only time i use it is on sights that might send me junk.
But thanks for the heads up!

 

[silverpig]

I'm pretty happy about this as I use my gmail for everything. I have all my real email accounts set to forward to gmail, I can send email from any of my real accounts through gmail, I get gmail on my ipod, it's basically the center of my email world.

 

[Raduque]

Why is that douchebag going to release a tool like that?

 

[ForumMaster]

it was already setup that way for me.

 

[KLin]

Originally posted by: Raduque
Why is that douchebag going to release a tool like that?

Because he can.

 

[Nik]

Sweet, thank you!

 

[middlehead]

I'd been using extensions to cover this for a while now, bout damn time Google did it themselves.

 

[imported_FishTaco]

Originally posted by: Steve
It seems to break Gmail Notifier, at least for me.

EDIT 2: Nope, still broken.

Fix for gmail notifier after turning on the always use https setting.

http://mail.google.com/support.../answer.py?answer=9429

 

[Steve]

Originally posted by: FishTaco

Originally posted by: Steve
It seems to break Gmail Notifier, at least for me.

EDIT 2: Nope, still broken.

Fix for gmail notifier after turning on the always use https setting.

http://mail.google.com/support.../answer.py?answer=9429

 

[biggestmuff]

You are also able to see if any other gmail sessions are open. The tiny script and third line up from the bottom, click 'Details'. A window will popup and will tell you any other open gmail sessions. You may then log out the other session.

 

[MmmSkyscraper]

Originally posted by: Anubis
guess its a good thing that i dont use gmail

It also affects other providers:

This attack also works against yahoo mail, hotmail, etc. Just Yahoo, hotmail, etc don't even OFFER SSL, so well, if you use them, your FSCKed.

http://it.slashdot.org/comment...id=650271&cid=24659297

 

[OutHouse]

done and thanks for the info.

 

[FeuerFrei]

Fixed.
However, I 'never' check my Gmail with my browser.
I go with POP access via Outlook Express.

 

[George P Burdell]

Originally posted by: newb111
That setting doesn't seem to exist for google apps for domain. Oh well. I just make sure all my bookmarks for gmail use https.

There is a GreaseMonkey script called GMailSecure that will always switch gmail & gmail for apps from http to https.

 

[CKent]

:beer: thanks

 

[Krazy4Real]

Done. Thanks.

 

[Maleficus]

Thanks.

 

[Ricemarine]

Thanks for the heads up OP.

 

[CptCrunch]

already done, thanks for the psa for everybody else though

 

[Codewiz]

I guessing not many here read how this works?

Just using https while not enabling the preference will not fix it. This vulnerability only works when the attacker can grab your session id over unsecured channels. E.g. unprotected wireless in places like airports. The attacker much has access to sniff your connection. Then the attack provides a page that links back to a http page at google. Google will give up your session ID because you are already authenticated. The attacker can then take the session id and use your account.

If you don't set this preference in google, the attack will still work even though you use https. You MUST set the preference to always use HTTPS and google will ignore the http request.

So in laymans terms this is what is required.

Access to sniffing your connection.
Preference not set
Get you to click on a link that links to some image on googles non secure http page.
Attacker grabs your session id and runs away with your account.

GOOD BROWSING PRACTICES!!!! Especially if paranoid.
Go home and setup an SSH server
Learn how to use SSH to tunnel traffic
Anytime you are using an UNTRUSTED wireless connection use the ssh tunnel

 

[Steve]

Errors in the Gmail for mobile application may result from enabling this setting. Learn more:

http://mail.google.com/support...nswer.py?answer=100210

 

[clamum]

Originally posted by: KLin

Originally posted by: Raduque
Why is that douchebag going to release a tool like that?

Because he can.

Yeah that's what I'm wondering, why do something like that? Douchebag is right. :thumbsdown:

 

[jjones]

Gmail is a junk mailbox for me so I'm not bothering with this; besides, as per Codewiz's post describing the nature of the attack, it's extremely unlikey (read: never) that I'll ever be subject to it.

But thanks for the heads up anyway.