Is Google overreaching by forcing me to use TLS?

Question

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts?

Some have criticized Google for being Evil by forcing them into a secure connection even if they don't want to be secure. They argue that if it's just their own account, shouldn't they be the only one to decide whether or not to secure themselves?

^{Note: This question was posted in reference to the article linked above in order to provide a canonical answer to the question being asked off-site (which is why it was answered by the same person who asked it).}

Answer 1

It's not just about you. By forcing users to use TLS, they're creating a more secure environment for everyone.

Without TLS being strictly enforced, users are susceptible to attacks such as sslstrip. Essentially, making unencrypted connections an option leads to the possibility of attackers forcing users into unencrypted connections.

But that's not all. Requiring TLS is the first step in moving toward HSTS enforcement on the google.com domain. Google already does opportunistic HSTS enforcement -- which is to say that they don't require TLS, but they do restrict which certificates are allowed to be used on Google.com (nb: this technique is now called HPKP). That's an improvement, but it's not ultimately a solution.

For full HSTS enforcement, they need to ensure that requiring TLS on all Google services within the domain won't break any necessarily third-party solutions. Once enforcement is turned on, it can't easily be turned off. So by moving services one-by-one to strict TLS enforcement, they are paving the way toward making HSTS enforcement across the domain a reality.

Once this enforcement is in place, browsers will simply refuse to connect to Google over an insecure or compromised connection. By shipping this setting in the browser itself, circumvention will become effectively impossible.

Disclaimer: I work for Google now but I didn't work for Google when I wrote this. This is my opinion, not Google's (as should be immediately clear to anyone with a basic understanding of chronology).

Answer 2

Let me rephrase your question with a few extra details, which are implicit but maybe not obvious to everybody:

"Isn't Google being Evil by providing me with a free email service and gigabytes of storage and forcing me into a secure connection when I access that service which they have generously granted to me and that nobody forces me to use even if I don't want to be secure? If it's just my own account on their servers and given to me free of charge, based only to their usage terms to which I have agreed, shouldn't I be the only one to decide what should happen with THEIR servers and whether or not to secure myself with a technology whose costs are entirely on the server side and with no actual disadvantage to me ?"

Truly, the nerve they have at Google !

---

Commentary: reactions against Google in that respect look like knee-jerk reflexes: automatic, imperfectly targeted, and not involving any brain at all.

Answer 3

If Google wants the content of their servers to be transferred securely, that is entirely within their discretion, even if that content is your email box.

Answer 4

In fact, no, Google is not evil with this, not at all.

The first important thing about this is that the use of secure connection is not a user preference or some personalized setting. Some people might find this confusing because they are familiar with a system only from the position of an end-user. Being a software developer myself, I can tell you that security is done on application level and affects all users of the system. There is no way to technically enforce authentication security based on user choice without compromising the security of the entire system and all the other users, most of whom might rely on the system's protection of their data. Yet, if it is possible, I'd surely like to know how.

The logical choice for Google, as a public service provider, is to establish a secure environment for all of its users. It is not for the sake of security for the users only, but for the company too. Imagine, if someone becomes a victim of a security breach, and fires a lawsuit against Google, and proves that it is them who are responsible? This could be the case if they did not take the standard measures to protect the user data, and could have to face an entire community of angry users in court. Not using HTTPS is an example for such a thing - anyone can intercept your web request and see the information as a plain text. Google's user data is sensible. It seems like a simple email address and a password, but these two items form a key to all your contacts, correspondence and personalized Google services.

Moreover, Google is an OpenID provider, which means the same user password (the one of the Google account) can be used to authenticate to external systems (like the sites in the StackExchange network, including this one, YouTube, Disqus, Picasa and many other popular systems). It is hard for me to imagine that one would prefer to have his "key" to so many accounts and services being unsecured.

In general, this is a measure of technical requirements, rather than enforcement over user preferences. I, personally, would never trust a system that does not enforce the minimal security conditions like secure connection and authentication, when it comes to email, online payments and other services working with my private data.

Answer 5

Evil for forcing you to use a secure connection?

No, I don't think it's evil. It protects the community at large with no downside to you as an individual.

I think its only evil if they're forcing you to use SSL/TLS, then failing to use forward secrecy, thus giving you and everyone else using the service a false sense of security.

Without forward secrecy, your session can be archived for an indeterminate length of time, the private key later obtained (via whatever means; social engineering, theft, government) and your long-ago session decrypted.

With forward secrecy and ephemeral keys, that concern is seriously mitigated.

Who can enumerate the downsides of using a SSL/TLS connection? Anyone? :-)

There can be performance issues, but really only if the website is badly designed so that it requires lots and lots of fresh connections to serve content from a page. That kind of design will have a serious negative impact on a regular non-secure HTTP session, too.

The performance hit from HTTPS is virtually all in the connection handshake since it takes more round trips and a little bit of compute-intensive asymmetrical ciphering to gin up the symmetrical session key on the server and decrypt it on the client (asymmetrical encryption is real expensive compared to symmetrical encryption).

The compute cost of encrypting and decrypting the actual session data with a symmetrical cipher after the initial key exchange is negligible.

What does an enforced SSL/TLS session cost you? Offhand, I honestly don't believe there is a measurable cost to you.

Answer 6

It's sad that people's first reaction is to defend Google by using the "you don't HAVE to use it" fallacy. As for transaction of money, don't you think your own personal information which they sell to advertisers has monitory value? Google isn't free, it still requires a payment which most people don't even realize they are making.

Now, to answer the question, I don't think they are overreaching or "evil" for doing this. What if you look up information which could harm others if it's leaked (e.g. Googling something like "how do i treat my daughter's herpes"), or what if you're sending an email to another person who DOES want to be secured. Should it be up to you whether or not what THEY send is encrypted on your end? You may not care about security, but other people do, and it's only end-to-end if both ends actually enforce security. However, I would prefer if Google gave a method to use non-TLS connections if there are still devices which use Google but which are too memory/resource/entropy starved to establish a secure connection.

Answer 7

Google not only protects you and your data, but also themselves.

The vast majority of internet users out there does not know about security, and does not care about. When offering any insecure path as fallback, user's would use it, and if it is some man-in-the-middle breaking everything else.

If your account is compromised, that's not only a problem for you and your data, but also for google:

• Spam mails might be sent using their services
• Google's credibility for authentication (single sign on) will suffer
• An attacker might misuse services, leading to costs (for Google) they might not be able to get compensation for
• Recovering the account for you will require manual interaction, which involves costs

Security can also be a matter of saving money.

Answer 8

Was Google evil for requiring you to use the HTTP protocol instead of the Gopher protocol? I don't think most people would argue that it was. But if requiring the use of one protocol over another is not evil, then why would it be evil in this particular case: wrapping SSL around HTTP?

Answer 9

Googles hands are tied. Google arent just doing it to protect you. They are doing it to protect themselves. They dont want other people to mess with your stuff because they are carrying it for you, and they have a whole lot of legal obligations that come with hosting other peoples stuff. They are obligated to prevent any account being used in a way that makes a problem for others.

Answer 10

As others say, normally you have nothing to lose by using encryption instead of non-encryption, even if you think you don't need encryption.

But if you really want to access it non-encrypted (perhaps to prove to someone observing your line that you are doing nothing evil), you could set up some HTTP server, which itself connects to Google by HTTPS, and forward all requests and responses (suitably adapted).

You should modify the logo and some of the text so it doesn't look like you are directly using Google. And you should think about using HTTPS at least for the login procedure.

This should work for every "evil" server which only supports HTTPS.

Answer 11

TL;DR: It's better, but it's not good enough.

The chance of having a tapped connection versus the costs of this type of security are obvious and require no further consideration than "yes this is required".

It is vital to remember that SSL might not be perfect and the implementations are very unlikely to be waterproof. Additionally, especially in a case like Google, your privacy and letter-secret is not preserved by using SSL.

Effectively the only risk that Google prevents is forms of espionage by actors not powerful enough to subvert your computer, Google or SSL. It might also increase the effort for other actors.

It does not prevent all kinds of SSLStrip, as SSLstrip can do in transit reworking or even redirects. A common user won't notice the lack of a little SSL lock. A little extra magic could even bring back a new security lockpad.

Answer 12

Perhaps they should offer an option to disable SSL if necessary. Perhaps there are some encryption restrictions in some countries or network requirements that would prevent users from accessing the service. I can see some business and user value to providing insecure options, but the defaults should be secure.

However, Google likely made this as a business decision and you are bound by the terms of their service. Google always encrypts other information, like search results when you are logged on so log servers and stats can't read the keywords of your search. If you are not happy with the service being provided (too little or too much security) you can always switch providers. In the case of email, its trivial to use IMAP to actually get your data out and imported elsewhere.

I don't think they have allowed IMAP/POP access without encryption for some time now either.