Gmail with HTTPS

[deadly7]

http://gmailblog.blogspot.com/2008/07/making-security-easier.html
Google's little blog about it. Apparently there's a hack coming out soon that would allow someone sniffing packets on an unencrypted e-mail session to take advantage of the lack of protection and obtain the session information, therefore bypassing the need for login information.

[Sidoh]

I just turned it on.  Thanks.  I was under the impression that it was already across SSL the whole time... lol.

[MyndFyre]

That's not really anything new; I know I read a blog post about it about 1-2 months ago.

[Sidoh]

That's not really anything new; I know I read a blog post about it about 1-2 months ago.

Right.  However, the attack was shown at Defcon and the presenter said he plans to release the tool that automates the process in two weeks from now (from the /. article).  It's a friendly reminder if nothing else.

[deadly7]

That's not really anything new; I know I read a blog post about it about 1-2 months ago.

Yes, but the hack is what's new. It was revealed at DEFCON.
Srsly, RTFA.

[Newby]

That's not really anything new; I know I read a blog post about it about 1-2 months ago.

And if you think about it, you can sniff anybody's cookie if it's transmitted in plaintext and use it...

That goes for not just Gmail, but other mail services, social networking services... the list goes on.

I'm hoping I'm wrong. I'll tunnel everything I do on wireless from now on.

[iago]

And if you think about it, you can sniff anybody's cookie if it's transmitted in plaintext and use it...

That goes for not just Gmail, but other mail services, social networking services... the list goes on.

I'm hoping I'm wrong. I'll tunnel everything I do on wireless from now on.

It's absolutely true. Why wouldn't it be?

[Newby]

What makes this Gmail thing so special, then? Because someone released a hack to do it?

I should release a hack to steal MySpace/Facebook cookies. I'll be famous!

[iago]

Because it has the word "gmail" in it, of course.

"facebook" has the same effect.

[Sidoh]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

[Camel]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

The GWT app actually stores the cookie regardless, because when it sends a request it simply reads the session ID from the cookie.

If you don't check remember me, however, the cookie is stored as a session cookie, which is deleted when the browser window/tab closes, except in some special cases such as restoring recently closed tabs in firefox, where the session cookie is reanimated. You are guaranteed, at the very least, to lose the cookie when the application closes cleanly.

[iago]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

A site *always* uses cookies to remember who you are, even if the cookie only lasts for the session. The only alternative is to use trickery, like somebody's cache or ip address or something.

But yeah, I think it's ridiculous that sites like gmail and hotmail don't have SSL on for everybody, by default.

[Sidoh]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

A site *always* uses cookies to remember who you are, even if the cookie only lasts for the session. The only alternative is to use trickery, like somebody's cache or ip address or something.

But yeah, I think it's ridiculous that sites like gmail and hotmail don't have SSL on for everybody, by default.

Passing the session ID around through the URLs works too.

[iago]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

A site *always* uses cookies to remember who you are, even if the cookie only lasts for the session. The only alternative is to use trickery, like somebody's cache or ip address or something.

But yeah, I think it's ridiculous that sites like gmail and hotmail don't have SSL on for everybody, by default.

Passing the session ID around through the URLs works too.

Well, yeah, but that's far worse.

[Sidoh]

Just saying.

[Camel]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

A site *always* uses cookies to remember who you are, even if the cookie only lasts for the session. The only alternative is to use trickery, like somebody's cache or ip address or something.

But yeah, I think it's ridiculous that sites like gmail and hotmail don't have SSL on for everybody, by default.

Passing the session ID around through the URLs works too.

Certain browsers don't allow global javascript variables, and while there are workarounds to that, they're all far more ugly than using cookies. Every major web app users cookies, period.

[Sidoh]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

A site *always* uses cookies to remember who you are, even if the cookie only lasts for the session. The only alternative is to use trickery, like somebody's cache or ip address or something.

But yeah, I think it's ridiculous that sites like gmail and hotmail don't have SSL on for everybody, by default.

Passing the session ID around through the URLs works too.

Certain browsers don't allow global javascript variables, and while there are workarounds to that, they're all far more ugly than using cookies. Every major web app users cookies, period.

I know.

[Quik]

I just turned it on.  Thanks.  I was under the impression that it was already across SSL the whole time... lol.

How were you able to set it so that it redirects you automatically to the secure site? I was thinking about this the other day, because I use GMail Notifier in my tray and it doesn't run HTTPS. Hrm.. guess I have to wait for them to update for that to work secure.

[Camel]

It's an option in the main settings page on the website. I'm not sure about notifier; I use several different flavors of notifiers on different computers, and I'd like to know too

I work at an IP company; ethereal is on the standard image that we use for new computers, because it's used by so many. All our switches are managed, etc. It really would be trivial for anyone who works here to hijack my gmail session.

[Sidoh]

I just turned it on.  Thanks.  I was under the impression that it was already across SSL the whole time... lol.

How were you able to set it so that it redirects you automatically to the secure site? I was thinking about this the other day, because I use GMail Notifier in my tray and it doesn't run HTTPS. Hrm.. guess I have to wait for them to update for that to work secure.

Does the updater use HTTP?  I could be the case that it's using IMAP with SSL.  I haven't used it in a long time.

[Camel]

Does the updater use HTTP?  I could be the case that it's using IMAP with SSL.  I haven't used it in a long time.

Yes; it's accessing the GWT-RPC service directly with HTTP.

[Explicit]

I just turned it on. Thanks. I was under the impression that it was already across SSL the whole time... lol.

How were you able to set it so that it redirects you automatically to the secure site? I was thinking about this the other day, because I use GMail Notifier in my tray and it doesn't run HTTPS. Hrm.. guess I have to wait for them to update for that to work secure.

What I did to solve that problem awhile back was hex edit Gmail Notifier. Run a string search for 'http://mail.google.com/mail/', and from there just change it to 'https://mail.google.com/mail/' without inserting any extra bytes (you're going to overwrite one of the bytes).

[Newby]

That would be good, but can it handle HTTPS connections?

[Camel]

What I did to solve that problem awhile back was hex edit Gmail Notifier. Run a string search for 'http://mail.google.com/mail/', and from there just change it to 'https://mail.google.com/mail/' without inserting any extra bytes (you're going to overwrite one of the bytes).

That sounds too simple to be true; I refuse to believe it

[Explicit]

Camel, do it.

[Sidoh]

That would be good, but can it handle HTTPS connections?

I'm assuming it uses a common library to handle its connections.  Most of the ones I've seen support stuff like HTTPS transparently.

[Camel]

Well, I turned on the option to force https, and google notifier is broken now. I suppose I'll have to hex it.

Is the byte following the string known to be unused? It seems likely that it is, since compilers tend to align strings.

[Explicit]

Well, I turned on the option to force https, and google notifier is broken now. I suppose I'll have to hex it.

Is the byte following the string known to be unused? It seems likely that it is, since compilers tend to align strings.

I'm assuming it's unused since I haven't experienced anything out of the norm when running the notifier, though it's not a safe assumption to make.

This is on Windows by the way.

[Quik]

Well, I turned on the option to force https, and google notifier is broken now. I suppose I'll have to hex it.

Is the byte following the string known to be unused? It seems likely that it is, since compilers tend to align strings.

Same thing happened to me.. so I fooled around with it in a hex editor, and now it seems to work. Not sure if it's completely secure though, you'd have to hex it and then sniff the traffic to test. Try it!

[Camel]

I got lazy and did the edit with vi in text mode; despite the file size changing by one byte, it still works. I've verified that it's using TLSv1.

[edit] Specifically, TLS_RSA_WITH_RC4_128_SHA