Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Default HTTPS access for Gmail

gmailblog.blogspot.com

Post reply on HN
Print view View original

11–20 of 31 posts

Re: Default HTTPS access for Gmail

#11

Post by vdm »

buro9 wrote: post #4
houseabsolute wrote: post #2

This whole incident seems to have put the fear of god in them.

I like this idea though, indeed I like the idea of the web being https by default. Where I find it funny in relation to email is that email passes over the internet in plain text and without Google adding PGP or something to Gmail the benefits for this aren't great. Considering the current incident with China, and the hacking in December. https for gmail will prevent snooping of gmail, but wouldn't prevent the email…

> I like the idea of the web being https by default.

I don't if it means no referers.

Re: Default HTTPS access for Gmail

#13

Post by mooism2 »

RK wrote: post #9
buro9 wrote: post #4

Earlier quoted context omitted.

I like this idea though, indeed I like the idea of the web being https by default. Where I find it funny in relation to email is that email passes over the internet in plain text and without Google adding PGP or something to Gmail the benefits for this aren't great. Considering the current incident with China, and the hacking in December. https for gmail will prevent snooping of gmail, but wouldn't prevent the email…

Ignoring the technical issues, Google doesn't want your free Gmail encrypted end-to-end because they rely on searching your email to serve you targeted ads (and deal with spam).

Presumably Google would decrypt your mail for you.

Re: Default HTTPS access for Gmail

#14

Post by xtho »

buro9 wrote: post #8
xtho wrote: post #7

Earlier quoted context omitted.

> I like the idea of the web being https by default. So that proxies become useless, the connection gets slower, data traffic increases, firefox users are plagued with warnings because people don't have proper certificats etc. At least 95% of the web-pages people are viewing are pointless bullshit anyway. It's not as if the casual internet user were using the potential freedom of the internet for anything good. Messa…

Thse are just problems to solve and not reasons not to proceed. In fact Google already have a whitepaper published for their SPDY protocol and that uses SSL everywhere: http://www.chromium.org/spdy/spdy-whitepaper

tl;dr :-)

But how should this solve the conflict of encryption/privacy vs caching?

Re: Default HTTPS access for Gmail

#15

Post by euroclydon »

I guess they put this off mainly because of the performance hit. I found the following quote regarding HTTP vs HTTPS performance on SO:

One point that has been brought up by several others is that SSL handshaking is the major cost of HTTPS. That is correct, which is why "typical session length" and "caching behavior of clients" are important.

Many, very short sessions means that handshaking time will overwhelm any other performance factors. Longer sessions will mean the handshaking cost will be incurred at the start of the session, but subsequent requests will have relatively low overhead.

SO Ref: http://stackoverflow.com/questions/149274/http-vs-https-perf...

I wonder which they view as more significant, gmail latency or increased server load?

Re: Default HTTPS access for Gmail

#16

Post by randallsquared »

vdm wrote: post #11
buro9 wrote: post #4

Earlier quoted context omitted.

I like this idea though, indeed I like the idea of the web being https by default. Where I find it funny in relation to email is that email passes over the internet in plain text and without Google adding PGP or something to Gmail the benefits for this aren't great. Considering the current incident with China, and the hacking in December. https for gmail will prevent snooping of gmail, but wouldn't prevent the email…

> I like the idea of the web being https by default. I don't if it means no referers.

It only means no referer if you change from one to the other. Different hosts using https pass referer normally.

Re: Default HTTPS access for Gmail

#17

Post by AndrewDucker »

forkqueue wrote: post #10
buro9 wrote: post #4

Earlier quoted context omitted.

I like this idea though, indeed I like the idea of the web being https by default. Where I find it funny in relation to email is that email passes over the internet in plain text and without Google adding PGP or something to Gmail the benefits for this aren't great. Considering the current incident with China, and the hacking in December. https for gmail will prevent snooping of gmail, but wouldn't prevent the email…

Actually, not all email passes in plain text - a decent chunk (although doubtless a minority) uses SMTP over TLS. Many servers have it configured, and if it's available on the destination almost all MTAs will use it to send mail to other servers, even if they don't support receipt of mail in this way.

Gmail uses TLS to encrypt SMTP if you're using a client app.

Re: Default HTTPS access for Gmail

#18

Post by acdha »

euroclydon wrote: post #15

I guess they put this off mainly because of the performance hit. I found the following quote regarding HTTP vs HTTPS performance on SO: One point that has been brought up by several others is that SSL handshaking is the major cost of HTTPS. That is correct, which is why "typical session length" and "caching behavior of clients" are important. Many, very short sessions means that handshaking time will overwhelm any ot…

I'd be surprised if the answer wasn't latency - this kind of server load would be easy to scale with their engineering resources and they're big on the competitive advantage of user-perceived performance.
Post reply on HN