News, info, and opinion by Mac users, for Mac users.

July 10, 2007

tips

Secure your Gmail Notifier

Posted Jul. 10, ’07, 6:34 AM PT by Derik DeLong
Category | Tips

Google NotifierUpdate: According to one of our commenters below who claims to work for Google, Gmail notifier does not send your authentication info in the clear. We’ll keep our eyes open for more info, but enabling this setting probably won’t hurt. -DM

I’m still hooked on Gmail’s conversation view for keeping up with my mailing lists. To keep on top of incoming mail in that account, I use Google’s Notifier application. For my purposes, it works well, keeping the unread email count in my menubar.

Unfortunately, Google configures it by default not to use https. That means that every time the application authenticates to Google’s server to check for new mail, your password is being sent in the clear over the internet. In most cases, this isn’t a problem, but if you’re using a public hotspot, your wireless router is unsecured, or you’re staying at a hotel, pretty much anyone in your vicinity could be capturing your username and password. Not cool.

A tip on Mac OS X Hints gives the solution (which also keeps you in secure mode when reading your email assuming you use the notifier’s Go to Inbox command).

Pull down the Notifier menu (either Calendar or Gmail), hold down Command and Option, and click Preferences on the menu. You’ll see a hidden settings editor. Enter SecureAlways in the Key field (upper and lower case must be entered as shown) and 1 in the Value field, then click Set. Quit Notifier and start it up again. From now on, all connections with both Gmail & Gcal will be https.

Hopefully Google will make this default in the future or at least reveal this preference in a more accessible location.


2 Comments

Avi Drissman said:

This is not true; Notifier does not send your password in the clear over the internet. Disclosure: I work for Google, but please feel free to investigate this yourself.

July 10, 2007 7:15 AM
sdk said:

I don't use this feature of gmail, but it would seem that someone should be able to capture their own packets using something like Ethereal/Ettercap/tcpdump/what have you, and find out first hand...

July 10, 2007 11:32 AM

Leave a comment

 



Visit other IDG sites: