About a month ago, Google added a useful security feature to Gmail: encryption.  If you select the “Always use https” option in your Gmail account settings, Gmail will set up an encrypted connection between you and the Gmail servers, similar to the connections you’re used to with, say, Amazon.com.

You ought to use https with Gmail, especially if you access Gmail on unsecured wifi networks in public places.  Without https, a tech-savvy person sitting nearby could — if properly motivated — sniff your packets and hijack your account.

Soon, that may change, for the worse.  A security researcher is planning to release a tool that anyone can use to hijack Gmail accounts.  He’s not a “black hat” hacker, so why would he do this?  It appears that he’s trying to prod Google into advertising the importance of https to its Gmail users.  I’m not sure I agree with his methods, but that’s not the point.  The takeaway is to update your Gmail settings to use https.

Submitted by: Dan Giancaterino, Internet Librarian
on August 20, 2008 - 9:07 am

| More Google, Privacy/Security Posts