Image
© Scroogle.org
Just hours after Google disclosed it and at least 20 other large companies were the targets of highly sophisticated cyberattacks, the online giant said it would enhance the security of its email service by automatically encrypting entire web sessions.

The change, which Google is in the process of rolling out now, means Gmail sessions will be automatically protected from start to finish with the SSL, or secure sockets Layer, protocol, even if a user doesn't specifically ask for it. Up until now, users had to check a setting in their Gmail options to get always-on encryption.

The change bolsters Google's already significant lead in protecting web users against so-called man-in-the-middle attacks, which allow miscreants to read and modify web traffic by sitting in between victims and the sites they surf. Yahoo Mail, eBay, MySpace, Facebook, and a wide variety of other sites continue to offer https encryption only when users are logging in, making email and other sensitive pages that are visited later susceptible to so-called sidejacking and similar attacks.

The change, which many security advocates had demanded, was announced a few hours after Google accused China-based hackers of carrying out highly sophisticated attacks designed to ferret out human rights advocates. Exploits targeting Gmail services largely failed, but Google said "dozens" of accounts had been routinely accessed by unauthorized parties through phishing or malware attacks on the users themselves.

Comment: As The Guardian explains here, these attacks took place back in December. This switch to encrypted email has been announced today, a month later, on the heels of Google's revelation that said activists' accounts were hacked, thus giving the impression that Google's discovery of the accounts being hacked prompted it to react by 'pulling out of China' and making all emails from all Gmail accounts "secure" with encryption. This lapse, coupled with the curious synchronisation of a crippling attack on Google's main competitor in China, Baidu.com, while Google positioned itself as the champion of human rights and email privacy, raises many questions.

Why did Google wait until the following month to reveal these attacks, which it claims came from China? What are the odds that a cyberwarfare 'counter-attack' takes down Google's Chinese rival the day before its announcement? Is this a smokescreen or a distraction for something else?

There is of course no such thing as a free lunch, so the fact that Google Inc. has moved to encrypt all its users' emails at no charge, under the pretext of what appears to be a false-flag cyber-terror attack [see Sott.net comments], naturally has us wondering what Google and its patrons are really up to.

Google didn't elaborate on those attacks, so there's no way to know if always-on encryption would have prevented those account holders from being compromised. Still, the automatic use of https makes good sense and allows Google to rightfully claim even more higher ground relative to its peers. (Twitter is one of the few other popular services to offer start-to-finish https).

"We initially left the choice of using it up to you because there's a downside: https can make your mail slower since encrypted data doesn't travel across the web as quickly as unencrypted data," Gmail Engineering Director Sam Schillace wrote. "Over the last few months, we've been researching the security/latency tradeoff and decided that turning https on for everyone was the right thing to do."

Those who want to disable the feature may do so by checking a "Don't always use https" box in Gmail settings. Even then, Gmail login pages will continue to be encrypted.

Those using offline Gmail over naked http are likely to encounter problems. Troubleshooting tips are here.