Gmail with HTTPS

[deadly7]

http://gmailblog.blogspot.com/2008/07/making-security-easier.html
Google's little blog about it. Apparently there's a hack coming out soon that would allow someone sniffing packets on an unencrypted e-mail session to take advantage of the lack of protection and obtain the session information, therefore bypassing the need for login information.

[Sidoh]

I just turned it on.  Thanks.  I was under the impression that it was already across SSL the whole time... lol.

[MyndFyre]

That's not really anything new; I know I read a blog post about it about 1-2 months ago.

[Sidoh]

That's not really anything new; I know I read a blog post about it about 1-2 months ago.

Right.  However, the attack was shown at Defcon and the presenter said he plans to release the tool that automates the process in two weeks from now (from the /. article).  It's a friendly reminder if nothing else.

[deadly7]

That's not really anything new; I know I read a blog post about it about 1-2 months ago.

Yes, but the hack is what's new. It was revealed at DEFCON.
Srsly, RTFA.

[Newby]

That's not really anything new; I know I read a blog post about it about 1-2 months ago.

And if you think about it, you can sniff anybody's cookie if it's transmitted in plaintext and use it...

That goes for not just Gmail, but other mail services, social networking services... the list goes on.

I'm hoping I'm wrong. I'll tunnel everything I do on wireless from now on.

[iago]

And if you think about it, you can sniff anybody's cookie if it's transmitted in plaintext and use it...

That goes for not just Gmail, but other mail services, social networking services... the list goes on.

I'm hoping I'm wrong. I'll tunnel everything I do on wireless from now on.

It's absolutely true. Why wouldn't it be?

[Newby]

What makes this Gmail thing so special, then? Because someone released a hack to do it?

I should release a hack to steal MySpace/Facebook cookies. I'll be famous!

[iago]

Because it has the word "gmail" in it, of course.

"facebook" has the same effect.

[Sidoh]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

[Camel]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

The GWT app actually stores the cookie regardless, because when it sends a request it simply reads the session ID from the cookie.

If you don't check remember me, however, the cookie is stored as a session cookie, which is deleted when the browser window/tab closes, except in some special cases such as restoring recently closed tabs in firefox, where the session cookie is reanimated. You are guaranteed, at the very least, to lose the cookie when the application closes cleanly.

[iago]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

A site *always* uses cookies to remember who you are, even if the cookie only lasts for the session. The only alternative is to use trickery, like somebody's cache or ip address or something.

But yeah, I think it's ridiculous that sites like gmail and hotmail don't have SSL on for everybody, by default.

[Sidoh]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

A site *always* uses cookies to remember who you are, even if the cookie only lasts for the session. The only alternative is to use trickery, like somebody's cache or ip address or something.

But yeah, I think it's ridiculous that sites like gmail and hotmail don't have SSL on for everybody, by default.

Passing the session ID around through the URLs works too.

[iago]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

A site *always* uses cookies to remember who you are, even if the cookie only lasts for the session. The only alternative is to use trickery, like somebody's cache or ip address or something.

But yeah, I think it's ridiculous that sites like gmail and hotmail don't have SSL on for everybody, by default.

Passing the session ID around through the URLs works too.

Well, yeah, but that's far worse.

[Sidoh]

Just saying.