Optional Gmail "feature" really an exploit fix

Cyndy Aleo-Carreira — Wed, 20 Aug 2008 01:55:33 -0400

Last month, Google rolled out an SSL feature for Gmail to thwart an exploit brought to them a year ago and later publicly presented at the recent Defcon conference, according to Hacking Truths. There was no announcement for the new feature, and it was offered as an option, which I'm willing to bet was largely ignored.

Gmail is a perpetual beta, but should still bear some responsibility for its users' security. If they really did have a year to issue a fix, and left it to an optional "feature" with no explanation to their users, they've pushed that responsibility back to their users without even a basic explanation of the protection it provides. If you click the "learn more" link, the text provided by Google actually sounds like it's discouraging users from enabling the feature, stating:

"Please note that selecting 'Always use https' will prevent you from accessing Gmail via HTTP (Hypertext Transfer Protocol). In addition, it may make Gmail a bit slower. If you trust the security of your network, you can turn this feature off at any time."

More news, commentary, and predictions from The Industry Standard:

Prediction: Gmail announces free, unlimited storage space
News: GMail outage provides weapon for cloud-haters
News: Google Mobile App for iPhone
Picture this: Gmail is down

Optional Gmail "feature" really an exploit fix

Cyndy Aleo-Carreira — Wed, 20 Aug 2008 01:55:33 -0400

"Please note that selecting 'Always use https' will prevent you from accessing Gmail via HTTP (Hypertext Transfer Protocol). In addition, it may make Gmail a bit slower. If you trust the security of your network, you can turn this feature off at any time."

More news, commentary, and predictions from The Industry Standard:

Prediction: Gmail announces free, unlimited storage space
News: GMail outage provides weapon for cloud-haters
News: Google Mobile App for iPhone
Picture this: Gmail is down

Optional Gmail "feature" really an exploit fix

Cyndy Aleo-Carreira — Wed, 20 Aug 2008 01:55:33 -0400

"Please note that selecting 'Always use https' will prevent you from accessing Gmail via HTTP (Hypertext Transfer Protocol). In addition, it may make Gmail a bit slower. If you trust the security of your network, you can turn this feature off at any time."

More news, commentary, and predictions from The Industry Standard:

Prediction: Gmail announces free, unlimited storage space
News: GMail outage provides weapon for cloud-haters
News: Google Mobile App for iPhone
Picture this: Gmail is down