Problems With SSL in Gmail
Gmail, which is Google's free email service, has been found to be vulnerable to security threats when Secure Socket Layer protection is enabled. This is especially problematic when the user is accessing her email through a wireless connection in a public place.
Other People Are Reading
-
Background
-
SSL is a common encryption method for securing data over web servers and web browsers. Verisign describes SSL certificates as similar to a driver's license or passport, because a unique certificate is issued to a domain and web server. When SSL is enabled through Gmail, this allows Gmail to protect the user's password when he logs into his email account.
Features
-
When a user signs into Gmail, she has the option of permanently turning on the SSL protection even after she has logged in, preventing others from stealing her password. Other email programs use SSL, but only for the first-time authentication and signing into the user's email account, after which the non-encrypted mode is enabled.
-
Vulnerability
-
At the 2008 DEFCON conference for hackers, security researchers demonstrated how hackers could gain unauthorized access to Gmail accounts. The problem is that often the Gmail program will revert to a non-encrypted mode if Hypertext Transfer Protocol Secure (HTTPS) is not available. According to ZDNet, this means that Gmail users are vulnerable, unless they use a secure wireless connection or a virtual private network gateway.
-
