Feeds

Google flips default switch for always-on Gmail crypto

Hours after dropping Chinese hack bomb

SANS - Survey on application security programs

Just hours after Google disclosed it and at least 20 other large companies were the targets of highly sophisticated cyberattacks, the online giant said it would enhance the security of its email service by automatically encrypting entire web sessions.

The change, which Google is in the process of rolling out now, means Gmail sessions will be automatically protected from start to finish with the SSL, or secure sockets Layer, protocol, even if a user doesn't specifically ask for it. Up until now, users had to check a setting in their Gmail options to get always-on encryption.

The change bolsters Google's already significant lead in protecting web users against so-called man-in-the-middle attacks, which allow miscreants to read and modify web traffic by sitting in between victims and the sites they surf. Yahoo Mail, eBay, MySpace, Facebook, and a wide variety of other sites continue to offer https encryption only when users are logging in, making email and other sensitive pages that are visited later susceptible to so-called sidejacking and similar attacks.

The change, which many security advocates had demanded, was announced a few hours after Google accused China-based hackers of carrying out highly sophisticated attacks designed to ferret out human rights advocates. Exploits targeting Gmail services largely failed, but Google said "dozens" of accounts had been routinely accessed by unauthorized parties through phishing or malware attacks on the users themselves.

Google didn't elaborate on those attacks, so there's no way to know if always-on encryption would have prevented those account holders from being compromised. Still, the automatic use of https makes good sense and allows Google to rightfully claim even more higher ground relative to its peers. (Twitter is one of the few other popular services to offer start-to-finish https).

"We initially left the choice of using it up to you because there's a downside: https can make your mail slower since encrypted data doesn't travel across the web as quickly as unencrypted data," Gmail Engineering Director Sam Schillace wrote. "Over the last few months, we've been researching the security/latency tradeoff and decided that turning https on for everyone was the right thing to do."

Those who want to disable the feature may do so by checking a "Don't always use https" box in Gmail settings. Even then, Gmail login pages will continue to be encrypted.

Those using offline Gmail over naked http are likely to encounter problems. Troubleshooting tips are here. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.