Wednesday, August 20, 2008 12:33:48 AM
defcon, ssl, gmail
At this year's DEFCON, a tool was shown which allows an attacker to highjack Gmail accounts.
Article link
here.
Saturday, July 26, 2008 2:22:07 AM
google services, gmail, greasemonkey, google
...
In Oct 13 2006, I created a user javascript called
Google Secure Pro with the hopes of making my google experience more secure. The script forces several Google service to use SSL rather than regular http for the session. Basically, it encrypts the connection to ensure that you're the only one that's reading it. Back then, there was already a script called
GMailSecure, but this script only secured the connection to
GMail. I was looking for a script that enabled the SSL connection not only for GMail, but also for any other Google service which supported it. The first services supported were
GMail and
Google Calendar. Later on, I added support for
Google Reader,
Google Documents,
Google Bookmarks,
Google Groups, and
Google Sites.
User FF3user from the
UserScripts.org community recently asked about the differences between
Google Secure Pro and another script called
Google Secure.
Google Secure forces SSL on
https://www.google.com/accounts/* https://www.google.com/a/* http://mail.google.com/a/*.
Google Secure Pro forces SSL on
http://mail.google.com/* http://www.google.com/calendar/* http://docs.google.com/* http://spreadsheets.google.com/* http://www.google.com/reader/* http://www.google.com/bookmarks/* http://www.google.com/history/* http://groups.google.com/* http://sites.google.com/*Last night, I released a new version of Google Secure Pro, adding support for Google Sites. The script can be downloaded on the userscripts.org page. You need to be running
Opera 9+ or
Firefox 2+ with the
greasemonkey extension.
Just today, GMail released a new feature which allows an SSL connection to be always used when using GMail. They also explain that the SSL connection is not forced because since the information has to be decrypted, it makes your email experience slower. You can read the full blog post
here.
If you are a regular Google user and use any of the services listed above from work or a public computer, I advise you to try one of the scripts listed and to turn on the SSL option on GMail.
Hope this helps.