A Good Reason To Go Full-Time SSL For Gmail

jmke · 19th August 2008, 18:26

A tool that automatically steals IDs of non-encrypted sessions and breaks into Google Mail accounts has been presented at the Defcon hackers' conference in Las Vegas. Last week, Google introduced a new feature in Gmail that allows users to permanently switch on SSL and use it for every action involving Gmail, not just authentication. Users who did not turn it on now have a serious reason to do so, as Mike Perry, the reverse engineer from San Francisco who developed the tool, is planning to release it in two weeks.

http://www.hungry-hackers.com/2008/0...king-tool.html

20th August 2008, 16:34

aha, now I know why they introduced an option to prevent you from signing in using the http protocol

.

21st August 2008, 14:46

Here's a guide to hack Gmail Notifier to work with SSL Gmail. Without this Gmail Notifier does not work when the account is set to use SSL.

http://www.wikihow.com/Hack-Gmail-Notifier-to-Use-SSL

jmke · 21st August 2008, 14:49

use Google Talk Labs Edition, SSL notification working nicely

21st August 2008, 18:49

Quote:

Originally Posted by Kougar

Here's a guide to hack Gmail Notifier to work with SSL Gmail. Without this Gmail Notifier does not work when the account is set to use SSL.

http://www.wikihow.com/Hack-Gmail-Notifier-to-Use-SSL

official patch: http://mail.google.com/support/bin/a...py?answer=9429

21st August 2008, 19:24

Patch does the same thing. Just a little text editing in a hex editor, needed to change the URL...

Nice they have a patch though, didn't spot it.

19th August 2008, 18:26	#1
jmke Madshrimp Join Date: May 2002 Location: 7090/Belgium Posts: 79,021	A Good Reason To Go Full-Time SSL For Gmail A tool that automatically steals IDs of non-encrypted sessions and breaks into Google Mail accounts has been presented at the Defcon hackers' conference in Las Vegas. Last week, Google introduced a new feature in Gmail that allows users to permanently switch on SSL and use it for every action involving Gmail, not just authentication. Users who did not turn it on now have a serious reason to do so, as Mike Perry, the reverse engineer from San Francisco who developed the tool, is planning to release it in two weeks. http://www.hungry-hackers.com/2008/0...king-tool.html __________________

21st August 2008, 14:49	#4
jmke Madshrimp Join Date: May 2002 Location: 7090/Belgium Posts: 79,021	use Google Talk Labs Edition, SSL notification working nicely __________________

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
XClio Blackhawk Full Tower Chassis	jmke	WebNews	0	4th February 2010 08:16
Corsair Obsidian 800D Full Tower Chassis	jmke	WebNews	0	4th September 2009 12:33
NZXT Zero 2 Full Tower Chassis Review	jmke	WebNews	0	31st March 2009 18:07
NZXT Zero 2 Full Tower Chassis	jmke	WebNews	0	31st March 2009 18:06
Cooler Master HAF 932 Full Tower ATX case review	jmke	WebNews	0	16th December 2008 15:16
Full Solid CAP and big heat-pipe MB on Intel platform – MSI P35 Platinum first look	windwithme	General Madness - System Building Advice	7	2nd May 2007 14:37
Sharp Introduces Full Hd 1080p Aquos Lcd Tvs Optimized For Gaming	jmke	WebNews	1	18th January 2007 22:47
HOWTO: Troubleshoot Any Networking Problem	jmke	FAQ / INFO / HOW-TO	0	15th February 2006 13:33
LCD Panels with Response Time Compensation	Sidney	WebNews	0	21st December 2005 12:44

20th August 2008, 16:34	#2
wutske Posts: n/a	aha, now I know why they introduced an option to prevent you from signing in using the http protocol .

21st August 2008, 14:46	#3
Kougar Posts: n/a	Here's a guide to hack Gmail Notifier to work with SSL Gmail. Without this Gmail Notifier does not work when the account is set to use SSL. http://www.wikihow.com/Hack-Gmail-Notifier-to-Use-SSL

21st August 2008, 19:24	#6
Kougar Posts: n/a	Patch does the same thing. Just a little text editing in a hex editor, needed to change the URL... Nice they have a patch though, didn't spot it.