Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Access Gmail via a secure connection Web Browsers
While out browsing and surfing around for hints a while back, I came across this entry on Dave Taylor's site. In the post, Dave describes an amazingly simple method for making a secure connection to your Gmail account: After logging in, change the http:// prefix of the URL to https:// and press Return. The page will reload, and you'll see the secure lock icon in the corner of Safari's screen.

While searching around to see where else this might have been mentioned, I happened upon this page at the Google Help Center, with an even nicer answer -- just use https://mail.google.com/ as the URL, and you'll have a secure connection. I've been using Gmail for a long time, and had no idea they had a secure connection available (beyond the login screen), so I thought this worth sharing, even though it's documented. (And Dave's article pre-dates the "modified" date on the Google help entry, so it's possible that page didn't exist when Dave wrote his piece.)
    •    
  • Currently 3.00 / 5
  You rated: 4 / 5 (4 votes cast)
 
[20,571 views]  

Access Gmail via a secure connection | 18 comments | Create New Account
Click here to return to the 'Access Gmail via a secure connection' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Access Gmail via a secure connection
Authored by: the_webmaestro on Jan 26, '07 08:02:46AM

I consider this the tip of the week/month... Thank you! Thank you! Thank you! Thank you! Thank you! Thank you!

---
Father of Jeremy & Elliott



[ Reply to This | # ]
Access personalized Google via a secure connection
Authored by: kafka007 on Jan 26, '07 08:40:34AM
also works with https://www.google.com/ig?hl=en

[ Reply to This | # ]
Access personalized Google via a secure connection
Authored by: lar3ry on Jan 29, '07 04:56:21AM

However... (and BIG caveat)...

If you have Google Home showing your GMail and click on a message in your in-box, it will open an insecure connection to GMail.

I like GMail and using Google via secure connection, but this is a bit of a problem.



[ Reply to This | # ]
Access Gmail via a secure connection
Authored by: figz on Jan 26, '07 08:46:05AM
Also works for Google Reader:
https://www.google.com/reader/view/


[ Reply to This | # ]
Use Greasemonkey to do this
Authored by: hedgeman on Jan 26, '07 09:28:44AM
You can download a script for the Greasemonkey extension to Firefox to automatically redirect you to the secure connection here. It can be modified to make the connection to any Google Service (e.g., Reader, Calendar, Personalized Homepage, etc) secure too.

[ Reply to This | # ]
Use CustomizeGoogle FF extension to do this
Authored by: Black_Skorpio on Jan 26, '07 02:16:41PM

Even better use CustomizeGoogle has secure connections for most Google connections, plus it lets you surf these services without ads...
That is; if you use Firefox...

CustomizeGoogle is a Firefox extension that enhance Google search results by adding extra information (like links to Yahoo, Ask.com, MSN etc) and removing unwanted information (like ads and spam). All features are optional and easily configured from the options menu. View a short introduction movie at www.customizegoogle.com

Download and install from Firefox extension repository here:
https://addons.mozilla.org/firefox/743/
or from CustomizeGoogle:
http://www.customizegoogle.com

---
----===~~oOo~~===----
// Bjarne Varoystrand aka Black Skorpio
Do to others what you want them to do to you

[ Reply to This | # ]

Access Gmail via a secure connection
Authored by: 33Nick on Jan 26, '07 09:39:29AM

I agree Tip Of The Month!



[ Reply to This | # ]
Re: Access Gmail via a secure connection
Authored by: Uncle Asad on Jan 26, '07 11:13:03AM

I'm amazed (and saddened and scared) that people didn't know this already, and if it weren't a security tip, I'd officially complain about it being a non-hint ;) But security is serious, so I'm glad it's being publicized for all the folks who weren't aware of it.

Instead, I'll complain about service providers who don't make secure connections like this the default. (Given that many webmail providers are stupid like this, this hint will work with many other providers, e.g., Earthlink.) C'mon, providers; get with the program!



[ Reply to This | # ]
Re: Access Gmail via a secure connection
Authored by: igadget on Jan 26, '07 12:13:58PM

I'm not saying this is right, or the way it should be, just probably why.

The reason that the connection isn't set as secure by default for anything past login is possibly because of the load that it puts on the end server. As you move though Google normally, menus like account settings, you should see the site auto-magically switch back into secure mode.

This hint actually works for ANY SITE as a test to see if the site supports secure connections. Though I'd have to guess that searching for information on Google doesn't really need to be SSL encoded. As a long time admin (the company's mail belongs to the company, not to you), your mail isn't that interesting unless you are a spy or doing insider trading for a living. If you really want secure email use PGP not the web.



[ Reply to This | # ]
Re: Access Gmail via a secure connection
Authored by: luomat on Jan 28, '07 07:45:28PM
As a long time admin (the company's mail belongs to the company, not to you), your mail isn't that interesting unless you are a spy or doing insider trading for a living. If you really want secure email use PGP not the web.

You're kidding, right?

A) Yes, my email@work belongs to the company, but my Gmail belongs to me

B) PGP is a great idea which is a PITA to execute. You can only get secure mail from people who also have PGP. Good luck with that. Also, good luck getting it to work with webmail.

C) Yes I realize my email is unsecure from point A (sender) to B (his ISP) to C (my ISP... and maybe several stops in-between) but what I am more concerned about is "D" which is from my laptop to GMail. Right now I am on an open WiFi connection in a public spot. Great convenience, right? But I don't want anyone sniffing my email or passwords or anything else, regardless of how uninteresting it may be.

There are a lot of reasons why secure GMail is a good idea and PGP isn't the right answer.



[ Reply to This | # ]
Access Gmail via a secure connection
Authored by: stevebr on Jan 26, '07 12:05:24PM
In response to the "also works with..." comments above, it appears that many, if not all, of Google's web services are available over SSL, and reachable in the same manner as described in the hint.

However, international users may find that they get domain-mismatch warnings/errors on localized services (*.google.ca, for example), as the certificates correspond to www.google.com.

[ Reply to This | # ]
Access Gmail via a secure connection
Authored by: justbn on Jan 26, '07 07:17:24PM

Unfortunately, this does not seem to work with hosted accounts. I can login via HTTPS. However, it quickly reverts back to HTTP and does not stay secure after logging in.

Anyone know how to overcome this?

justin



[ Reply to This | # ]
Access Gmail via a secure connection
Authored by: johnqsmith on Jan 28, '07 02:00:26PM

I don't know what a "hosted" account is, but I believe generally gmail wraps ssl content inside some non-ssl frames or something like that. I'm not sure on the specifics of how the website formatting is done, I just know that when I look at my traffic with tcpdump I don't see any of the text of my mail in the traffic.



[ Reply to This | # ]
GAFYD Secure (RE: Access Gmail via a secure connection
Authored by: luomat on Jan 28, '07 07:37:01PM

I assume by "hosted" you mean Google for Your Domain (aka Google Apps For Your Domain).

It works for my Google Hosted email just fine.



[ Reply to This | # ]
Access Gmail via a secure connection
Authored by: Egon on Jan 26, '07 09:21:59PM
Just another note on this one.

At one point, very early on in the gmail system. The HTTPS was the default. When you entered http://www.gmail.com it would then come up as https://www.gmail.com. At some point, it was changed so you have to change your link like you are discussing to get the SSL.

E

[ Reply to This | # ]
Access Gmail via a secure connection
Authored by: Phyzzbin on Jan 27, '07 07:51:19AM

I've known how to this for a couple of weeks now thanks to Leo Laport and Steve Gibson's "Security Now" netcast. Major kudos to these guys! The real trick would be to get this to work with Google Notifier.



[ Reply to This | # ]
Access Gmail via a secure connection
Authored by: carcus on Apr 08, '07 10:49:51AM
THIS IS WRONG! It's secure by default!
Authored by: johnqsmith on Jan 28, '07 01:58:13PM

While I am happy that at least some of you want to be more secure, the fact of the matter is that it is already using SSL at the time that you submit the information. I know most of you don't know how to use a packet sniffer, but I do and I've tested it. It is very common for sites (like banks) to use http to show the front page but then submit the information with SSL. This is because it causes more load to send all the content of the front page encrypted.

While I think it is a good idea from a user-education perspective to always make the front page SSL encrypted, so that people know to look for the browser lock (ESPECIALLY for banks...who like to use their own "lock" icons that don't mean anything...I personally yelled at wellsfargo a lot until they made the front page ssl by default), but you can see why sites might not want to do this, especially sites with extremely high traffic. However, you should realize that google would never have gotten away with sending your credentials in the clear; us security people would have made sure it drew them bad PR ;)

One other tip I would mention though is that if you have a bank which is using non-ssl for the front page, it would be a much better idea to add the s (https) and then if it doesn't work complain to your bank (it may just be that they use a different server for the ssl traffic, but you should find out)



[ Reply to This | # ]