Re: node red, and black is wonky

On Fri, Apr 4, 2008 at 5:27 PM, Daniel Johnson <[email protected]> wrote:
> ...
>  I'm on gmail right now, and it's https 100% of the time not just at
>  login.  You don't want people reading your email in transit.  It isn't
>  just the login you want to protect.

you have to request the gmail via https, not just log in via https, in
order for gmail to default to ssl.  i usually bookmark:
"https://mail.google.com/mail/?auth=blah" to tell gmail that my
preference is SSL/TLS.

note that gmail does not bind auth cookies to "secure only", so
anything that links to a plaintext google domain will leak your
authentication cookie, allowing session hijack. (see "sidejacking" for
the gritty details)

if you want to enforce gmail ssl/tls behavior, you need to use a
browser filter (adblock works) or proxy that drops all http:// to
google on the floor, while letting https:// through (this has side
effects).  you can also use a transparent SSL MITM proxy to alter
cookie parameters allowing secure use of both http and https, but this
is quite advanced and a pain in the ass, even if the most robust
solution.

best regards,

-- 
The Personal Telco Project - http://www.personaltelco.net/
Donate to PTP: http://www.personaltelco.net/donate
Un/Subscribe:  http://lists.personaltelco.net/mailman/listinfo/general/
Archives:  http://news.gmane.org/gmane.network.wireless.portland.general/
Etiquette: http://www.personaltelco.net/index.cgi/MailingListEtiquette