Feeds

Google flips default switch for always-on Gmail crypto

Hours after dropping Chinese hack bomb

Providing a secure and efficient Helpdesk

Just hours after Google disclosed it and at least 20 other large companies were the targets of highly sophisticated cyberattacks, the online giant said it would enhance the security of its email service by automatically encrypting entire web sessions.

The change, which Google is in the process of rolling out now, means Gmail sessions will be automatically protected from start to finish with the SSL, or secure sockets Layer, protocol, even if a user doesn't specifically ask for it. Up until now, users had to check a setting in their Gmail options to get always-on encryption.

The change bolsters Google's already significant lead in protecting web users against so-called man-in-the-middle attacks, which allow miscreants to read and modify web traffic by sitting in between victims and the sites they surf. Yahoo Mail, eBay, MySpace, Facebook, and a wide variety of other sites continue to offer https encryption only when users are logging in, making email and other sensitive pages that are visited later susceptible to so-called sidejacking and similar attacks.

The change, which many security advocates had demanded, was announced a few hours after Google accused China-based hackers of carrying out highly sophisticated attacks designed to ferret out human rights advocates. Exploits targeting Gmail services largely failed, but Google said "dozens" of accounts had been routinely accessed by unauthorized parties through phishing or malware attacks on the users themselves.

Google didn't elaborate on those attacks, so there's no way to know if always-on encryption would have prevented those account holders from being compromised. Still, the automatic use of https makes good sense and allows Google to rightfully claim even more higher ground relative to its peers. (Twitter is one of the few other popular services to offer start-to-finish https).

"We initially left the choice of using it up to you because there's a downside: https can make your mail slower since encrypted data doesn't travel across the web as quickly as unencrypted data," Gmail Engineering Director Sam Schillace wrote. "Over the last few months, we've been researching the security/latency tradeoff and decided that turning https on for everyone was the right thing to do."

Those who want to disable the feature may do so by checking a "Don't always use https" box in Gmail settings. Even then, Gmail login pages will continue to be encrypted.

Those using offline Gmail over naked http are likely to encounter problems. Troubleshooting tips are here. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.