Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts?

Some have criticized Google for being Evil by forcing them into a secure connection even if they don't want to be secure? They argue if it's just their own account, shouldn't they be the only one to decide whether or not to secure themselves?

share|improve this question
5  
You might not want to secure yourself, but I can bet that 99% of other people want to be secure, especially when things like the NSA are still around. I mean I wouldn't like a stranger reading my Skype conversations - they are private. That's why we have them over the internet and not somewhere public. I wouldn't like some stranger on the other side of the world to read my emails. I often have a lot of sensitive emails that are very personal (not in that way! ;) . –  George H Mar 25 at 21:36
4  
Sometimes security can be enforced. HTTPS is an example for this. Although not perfect, it is far much better than pure HTTP. It basically costs nothing, and makes bulk surveillance harder. There were even thoughts for HTTP 2.0 to be SSL only. –  Karol Babioch Mar 26 at 0:06
125  
Is Google overreaching by forcing you to log in with a password? –  Stephen Touset Mar 26 at 0:16
5  
@Shadur Yes, it is. –  asteri Mar 26 at 17:43
18  
In order for this to be "evil", you'd have to argue that it causes some kind of harm. –  pjc50 Mar 27 at 10:27

12 Answers 12

If Google wants the content of their servers to be transferred securely, that is entirely within their discretion, even if that content is your email box.

share|improve this answer

It's not just about you. By forcing users to use TLS, they're creating a more secure environment for everyone.

Without TLS being strictly enforced, users are susceptible to attacks such as sslstrip. Essentially, making unencrypted connections an option leads to the possibility of attackers forcing users into unencrypted connections.

But that's not all. Requiring TLS is the first step in moving toward HSTS enforcement on the google.com domain. Google already does opportunistic HSTS enforcement -- which is to say that they don't require TLS, but they do restrict which certificates are allowed to be used on Google.com. That's an improvement, but it's not ultimately a solution.

For full HSTS enforcement, they need to ensure that requiring TLS on all Google services within the domain won't break any necessarily third-party solutions. Once enforcement is turned on, it can't easily be turned off. So by moving services one-by-one to strict TLS enforcement, they are paving the way toward making HSTS enforcement across the domain a reality.

Once this enforcement is in place, browsers will simply refuse to connect to Google over an insecure or compromised connection. By shipping this setting in the browser itself, circumvention will become effectively impossible.

share|improve this answer
27  
+1 herd immunity –  schroeder Mar 25 at 22:36
5  
It's not just about you. Shouldn't this be It's not just about me. –  VarunAgw Mar 27 at 18:17
7  
@VarunAgw it parses better this way. An conversation between two different people is mentally easier to follow than a confused monologue. –  tylerl Mar 27 at 18:23
3  
This is similar to how being immunized from a disease helps everyone (by no longer being able to contract the disease from you), not just yourself. –  asmeurer Mar 27 at 20:31
    
One of the reasons cited for using unencrypted connections in said article is performance. You could improve your answer by mentioning that Google services vs. Chrome browser are likely to use SPDY, which by construction avoids many of the performance drawbacks that HTTPS has. There will be only one encrypted channel which is being multiplexed across all connections, so all the negotiation overhead and TCP slowstart are gone. –  Isotopp Mar 28 at 8:19

Perhaps they should offer an option to disable SSL if necessary. Perhaps there are some encryption restrictions in some countries or network requirements that would prevent users from accessing the service. I can see some business and user value to providing insecure options, but the defaults should be secure.

However, Google likely made this as a business decision and you are bound by the terms of their service. Google always encrypts other information, like search results when you are logged on so log servers and stats can't read the keywords of your search. If you are not happy with the service being provided (too little or too much security) you can always switch providers. In the case of email, its trivial to use IMAP to actually get your data out and imported elsewhere.

I don't think they have allowed IMAP/POP access without encryption for some time now either.

share|improve this answer
2  
Even allowing the option to connect to HTTP instead of HTTPS opens the door to man-in-the-middle attacks. Not a good option for any server that provides access to critical data. –  Craig Mar 27 at 4:02
    
@Craig: please elaborate? Is there an attack that would leave the user thinking he is using a secure connection when he is not? –  immibis Mar 27 at 4:50
    
@immibis well, if the site will work over HTTP or HTTPS, then malware (I've seen this a number of times) on the computer itself could quietly redirect the browser to the HTTP version of the sites. If the server doesn't work over HTTP, this obviously wouldn't work. Also, SSLSTRIP (and by association its MIM kin) is mentioned at least once in other posts on this page. :-) –  Craig Mar 27 at 5:12
    
@Craig People who really care about security will have checked that they are using https, surely? –  immibis Mar 27 at 5:15
1  
@immibis you have no doubt gained some past insight into how savvy most "normal" people are about this stuff, right? :-) They just don't think about it, and that's part of the issue--the fact that so many people just don't even know which end is up and they get taken advantage of without even understanding what's happening to them. I honestly think it's good to have some protections in place for the ordinary average folks. One feature of SSL/TLS on a web server is that the web browser will bark at you if the certificate doesn't match the domain name. There's just a higher bar with HTTPS. –  Craig Mar 27 at 5:23

Let me rephrase your question with a few extra details, which are implicit but maybe not obvious to everybody:

"Isn't Google being Evil by providing me with a free email service and gigabytes of storage and forcing me into a secure connection when I access that service which they have generously granted to me and that nobody forces me to use even if I don't want to be secure? If it's just my own account on their servers and given to me free of charge, based only to their usage terms to which I have agreed, shouldn't I be the only one to decide what should happen with THEIR servers and whether or not to secure myself with a technology whose costs are entirely on the server side and with no actual disadvantage to me ?"

Truly, the nerve they have at Google !


Commentary: reactions against Google in that respect look like knee-jerk reflexes: automatic, imperfectly targeted, and not involving any brain at all.

share|improve this answer
32  
EVIL. That's what dey ar. Givin me free stuff and makin sure I stay safe. That's the Devil's bargain, that is. –  tylerl Mar 25 at 20:57
7  
Whether the service is free or not (and if you think about it, gmail is not free - the transaction simply doesn't involve $s) has nothing to do with the question. The question is simply whether it is good or bad that HTTPS is required and not left to users' choice. Free or not has nothing to do with it. The question seems perfectly valid (sans 'evil' reference, albeit 'evil' being grounded in not-so-subtle reference to Google's don't be evil and allowing users to have control over their data). –  LB2 Mar 25 at 21:06
8  
@LB2: what matters is that there is a transaction: you use Gmail based on agreed-upon terms of usage. The lack of money exchange means that the user lacks leverage to dictate his own conditions. The underlying tone is that people often forget that Google is not a public service that they are entitled to use, on their own terms. –  Tom Leek Mar 25 at 21:59
4  
Google isn't free? Please edit. I pay for Google like most online services by being bombarded with adds. Some services allow a paid version without adds including Google though enterprise licensing. –  Dean Meehan Mar 26 at 17:02
13  
"If you are not paying for the service, you are the product" –  Forkrul Assail Mar 27 at 13:59

It's sad that people's first reaction is to defend Google by using the "you don't HAVE to use it" fallacy. As for transaction of money, don't you think your own personal information which they sell to advertisers has monitory value? Google isn't free, it still requires a payment which most people don't even realize they are making.

Now, to answer the question, I don't think they are overreaching or "evil" for doing this. What if you look up information which could harm others if it's leaked (e.g. Googling something like "how do i treat my daughter's herpes"), or what if you're sending an email to another person who DOES want to be secured. Should it be up to you whether or not what THEY send is encrypted on your end? You may not care about security, but other people do, and it's only end-to-end if both ends actually enforce security. However, I would prefer if Google gave a method to use non-TLS connections if there are still devices which use Google but which are too memory/resource/entropy starved to establish a secure connection.

share|improve this answer
2  
+1 for mentioning that no, software companies don't give you free services out of their kind natures and gentle hearts. They want to make a profit, and you don't owe them anything for that. You're free to make any demands you please, even if they are as preposterous as this one, and they are free to refuse. –  Greg Ros Mar 29 at 0:14

In fact, no, Google is not evil with this, not at all.

The first important thing about this is that the use of secure connection is not a user preference or some personalized setting. Some people might find this confusing because they are familiar with a system only from the position of an end-user. Being a software developer myself, I can tell you that security is done on application level and affects all users of the system. There is no way to technically enforce authentication security based on user choice without compromising the security of the entire system and all the other users, most of whom might rely on the system's protection of their data. Yet, if it is possible, I'd surely like to know how.

The logical choice for Google, as a public service provider, is to establish a secure environment for all of its users. It is not for the sake of security for the users only, but for the company too. Imagine, if someone becomes a victim of a security breach, and fires a lawsuit against Google, and proves that it is them who are responsible? This could be the case if they did not take the standard measures to protect the user data, and could have to face an entire community of angry users in court. Not using HTTPS is an example for such a thing - anyone can intercept your web request and see the information as a plain text. Google's user data is sensible. It seems like a simple email address and a password, but these two items form a key to all your contacts, correspondence and personalized Google services.

Moreover, Google is an OpenID provider, which means the same user password (the one of the Google account) can be used to authenticate to external systems (like the sites in the StackExchange network, including this one, YouTube, Disqus, Picasa and many other popular systems). It is hard for me to imagine that one would prefer to have his "key" to so many accounts and services being unsecured.

In general, this is a measure of technical requirements, rather than enforcement over user preferences. I, personally, would never trust a system that does not enforce the minimal security conditions like secure connection and authentication, when it comes to email, online payments and other services working with my private data.

share|improve this answer

Evil for forcing you to use a secure connection?

No, I don't think it's evil. It protects the community at large with no downside to you as an individual.

I think its only evil if they're forcing you to use SSL/TLS, then failing to use forward secrecy, thus giving you and everyone else using the service a false sense of security.

Without forward secrecy, your session can be archived for an indeterminate length of time, the private key later obtained (via whatever means; social engineering, theft, government) and your long-ago session decrypted.

With forward secrecy and ephemeral keys, that concern is seriously mitigated.

Who can enumerate the downsides of using a SSL/TLS connection? Anyone? :-)

There can be performance issues, but really only if the website is badly designed so that it requires lots and lots of fresh connections to serve content from a page. That kind of design will have a serious negative impact on a regular non-secure HTTP session, too.

The performance hit from HTTPS is virtually all in the connection handshake since it takes more round trips and a little bit of compute-intensive asymmetrical ciphering to gin up the symmetrical session key on the server and decrypt it on the client (asymmetrical encryption is real expensive compared to symmetrical encryption).

The compute cost of encrypting and decrypting the actual session data with a symmetrical cipher after the initial key exchange is negligible.

What does an enforced SSL/TLS session cost you? Offhand, I honestly don't believe there is a measurable cost to you.

share|improve this answer
2  
On the other hand, a lot of people believe more widespread use of secure HTTP is a good idea, or put another way that SSL/TLS may well be a necessary layer. Any time any service requires credentials, the credentials must be protected with SSL/TLS. If authentication is secure, then the entire session needs to be secure (MIM attacks). Using SSL/TLS to protect authentication, then passing an unsecured auth token back and forth afterward is an error, good that Google stopped doing it. SSL/TLS is already in your browser. Using a secure site doesn't complicate your life. It should become the norm. –  Craig Mar 27 at 3:56
2  
@immibis, they are out there to get you buddy. –  OneOfOne Mar 28 at 12:22
1  
@immibis it's not just Google that is pushing for the entire Internet to be on TLS - so is the EFF, Mozilla, Microsoft... many other large companies. in fact, the IETF is considering/has considered making TLS a required part of the HTTP/2.0 spec. I never looked at the outcome of that, but last I heard they were going to make a strong recommendation for it, and only recommend turning it off in known-safe environments (e.g. corporate intranets). –  strugee Mar 30 at 2:00
2  
@strugee true, however computational expense isn't the only relevant factor. Network latency is a big issue that has to be taken into account. HTTPS requires twice as many round trips per session as HTTP to establish the connection. If your ping time is 50ms, it takes close to a quarater second to establish an HTTPS connection due to round-trip latency alone. That's why it is so important to re-use connections, combine scripts and css files, use css sprites instead of lots of requests for small images, and so on. All of these methods would dramatically speed up HTTP pages, as well. Win win. –  Craig Mar 30 at 3:02
2  
Multiple requests will still slow you down. Worse, though, is a requests full of requests to other sites (analytics JavaScript includes, anyone?), because each of those connections requires a fresh HTTPS connection. It's unconscionable for people not to at least be loading those kinds of scripts asynchronously. –  Craig Mar 30 at 3:10

TL;DR: It's better, but it's not good enough.

The chance of having a tapped connection versus the costs of this type of security are obvious and require no further consideration than "yes this is required".

It is vital to remember that SSL might not be perfect and the implementations are very unlikely to be waterproof. Additionally, especially in a case like Google, your privacy and letter-secret is not preserved by using SSL.

Effectively the only risk that Google prevents is forms of espionage by actors not powerful enough to subvert your computer, Google or SSL. It might also increase the effort for other actors.

It does not prevent all kinds of SSLStrip, as SSLstrip can do in transit reworking or even redirects. A common user won't notice the lack of a little SSL lock. A little extra magic could even bring back a new security lockpad.

share|improve this answer
    
It's not clear whether (cost of tapped connection * chance of tapped connection) > cost of TLS. But if Google doesn't mind paying the extra cost (if there is one), that's their choice. –  immibis Mar 27 at 1:14
    
The reason is mostly that TLS is so very cheap compared to any sort of human disaster. Maybe it's not even ALWAYS true, but it's not an interesting discussion. Given the choice someone will invariably choose "Create problems for me" mode. –  Lodewijk Mar 27 at 1:22
1  
I'm not saying it's bad - at least not for this reason. When you multiply a huge number and a tiny number, it's hard to know whether the result is huge or tiny. Google is just erring on the side of caution, which is a good thing. –  immibis Mar 27 at 1:25
    
Exactly! :) ________ –  Lodewijk Mar 27 at 1:30

As others say, normally you have nothing to lose by using encryption instead of non-encryption, even if you think you don't need encryption.

But if you really want to access it non-encrypted (perhaps to prove to someone observing your line that you are doing nothing evil), you could set up some HTTP server, which itself connects to Google by HTTPS, and forward all requests and responses (suitably adapted).

You should modify the logo and some of the text so it doesn't look like you are directly using Google. And you should think about using HTTPS at least for the login procedure.

This should work for every "evil" server which only supports HTTPS.

share|improve this answer

Was Google evil for requiring you to use the HTTP protocol instead of the Gopher protocol? I don't think most people would argue that it was. But if requiring the use of one protocol over another is not evil, then why would it be evil in this particular case: wrapping SSL around HTTP?

share|improve this answer

Googles hands are tied. Google arent just doing it to protect you. They are doing it to protect themselves. They dont want other people to mess with your stuff because they are carrying it for you, and they have a whole lot of legal obligations that come with hosting other peoples stuff. They are obligated to prevent any account being used in a way that makes a problem for others.

share|improve this answer

Google not only protects you and your data, but also themselves.

The vast majority of internet users out there does not know about security, and does not care about. When offering any insecure path as fallback, user's would use it, and if it is some man-in-the-middle breaking everything else.

If your account is compromised, that's not only a problem for you and your data, but also for google:

  • Spam mails might be sent using their services
  • Google's credibility for authentication (single sign on) will suffer
  • An attacker might misuse services, leading to costs (for Google) they might not be able to get compensation for
  • Recovering the account for you will require manual interaction, which involves costs

Security can also be a matter of saving money.

share|improve this answer
    
also, the possibility of lawsuits, as mentioned in other answers. –  strugee Mar 30 at 2:05

protected by AviD Mar 28 at 6:49

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.