Priveon Labs Security Blog

If you have a GMail account, you may have noticed the new "More GMail Security" link recently added by Google. One of the most notable changes is that GMail now forces HTTPS connections at login. This previously was an optional setting (off by default). I for one applaud GMail for making this simple but effective change. Forcing HTTPS prevents sniffing on untrusted networks as well as wireless session hijacking (aka "sidejacking") as discussed at BlackHat Vegas 2007 (Errata security's Ferret and Hamster tools). Now if other vendors will simply follow suit!