Gmail with HTTPS

[Camel]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

A site *always* uses cookies to remember who you are, even if the cookie only lasts for the session. The only alternative is to use trickery, like somebody's cache or ip address or something.

But yeah, I think it's ridiculous that sites like gmail and hotmail don't have SSL on for everybody, by default.

Passing the session ID around through the URLs works too.

Certain browsers don't allow global javascript variables, and while there are workarounds to that, they're all far more ugly than using cookies. Every major web app users cookies, period.

[Sidoh]

gmail doesn't have to use cookies.  The "remember me" checkbox will do this, but without it, I don't think it uses cookies.  This tool hijacks the session by looking for the session ids in the requests, from what I understand.  It's unlikely that it's anything fancy, but it's irrelevant.  This thread is saying "turn on always over https" not "omg look at these sweet hax".

A site *always* uses cookies to remember who you are, even if the cookie only lasts for the session. The only alternative is to use trickery, like somebody's cache or ip address or something.

But yeah, I think it's ridiculous that sites like gmail and hotmail don't have SSL on for everybody, by default.

Passing the session ID around through the URLs works too.

Certain browsers don't allow global javascript variables, and while there are workarounds to that, they're all far more ugly than using cookies. Every major web app users cookies, period.

I know.

[Quik]

I just turned it on.  Thanks.  I was under the impression that it was already across SSL the whole time... lol.

How were you able to set it so that it redirects you automatically to the secure site? I was thinking about this the other day, because I use GMail Notifier in my tray and it doesn't run HTTPS. Hrm.. guess I have to wait for them to update for that to work secure.

[Camel]

It's an option in the main settings page on the website. I'm not sure about notifier; I use several different flavors of notifiers on different computers, and I'd like to know too :P

I work at an IP company; ethereal is on the standard image that we use for new computers, because it's used by so many. All our switches are managed, etc. It really would be trivial for anyone who works here to hijack my gmail session.

[Sidoh]

I just turned it on.  Thanks.  I was under the impression that it was already across SSL the whole time... lol.

How were you able to set it so that it redirects you automatically to the secure site? I was thinking about this the other day, because I use GMail Notifier in my tray and it doesn't run HTTPS. Hrm.. guess I have to wait for them to update for that to work secure.

Does the updater use HTTP?  I could be the case that it's using IMAP with SSL.  I haven't used it in a long time.

[Camel]

Does the updater use HTTP?  I could be the case that it's using IMAP with SSL.  I haven't used it in a long time.

Yes; it's accessing the GWT-RPC service directly with HTTP.

[Explicit]

I just turned it on. Thanks. I was under the impression that it was already across SSL the whole time... lol.

How were you able to set it so that it redirects you automatically to the secure site? I was thinking about this the other day, because I use GMail Notifier in my tray and it doesn't run HTTPS. Hrm.. guess I have to wait for them to update for that to work secure.

What I did to solve that problem awhile back was hex edit Gmail Notifier. Run a string search for 'http://mail.google.com/mail/';, and from there just change it to 'https://mail.google.com/mail/'; without inserting any extra bytes (you're going to overwrite one of the bytes).

[Newby]

That would be good, but can it handle HTTPS connections?

[Camel]

What I did to solve that problem awhile back was hex edit Gmail Notifier. Run a string search for 'http://mail.google.com/mail/';, and from there just change it to 'https://mail.google.com/mail/'; without inserting any extra bytes (you're going to overwrite one of the bytes).

That sounds too simple to be true; I refuse to believe it :)

[Explicit]

Camel, do it. :)

[Sidoh]

That would be good, but can it handle HTTPS connections?

I'm assuming it uses a common library to handle its connections.  Most of the ones I've seen support stuff like HTTPS transparently.

[Camel]

Well, I turned on the option to force https, and google notifier is broken now. I suppose I'll have to hex it.

Is the byte following the string known to be unused? It seems likely that it is, since compilers tend to align strings.

[Explicit]

Well, I turned on the option to force https, and google notifier is broken now. I suppose I'll have to hex it.

Is the byte following the string known to be unused? It seems likely that it is, since compilers tend to align strings.

I'm assuming it's unused since I haven't experienced anything out of the norm when running the notifier, though it's not a safe assumption to make.

This is on Windows by the way.

[Quik]

Well, I turned on the option to force https, and google notifier is broken now. I suppose I'll have to hex it.

Is the byte following the string known to be unused? It seems likely that it is, since compilers tend to align strings.

Same thing happened to me.. so I fooled around with it in a hex editor, and now it seems to work. Not sure if it's completely secure though, you'd have to hex it and then sniff the traffic to test. Try it!

[Camel]

I got lazy and did the edit with vi in text mode; despite the file size changing by one byte, it still works. I've verified that it's using TLSv1.

[edit] Specifically, TLS_RSA_WITH_RC4_128_SHA