4 ms·
It sounds like a bad proxy cache is serving someone else's content to him. I'm just guessing, but I've seen it happen before (with both Gmail and FriendFeed).
by paul 18y ago
It sounds like a bad proxy cache is serving someone else's content to him. I'm just guessing, but I've seen it happen before (with both Gmail and FriendFeed).
- ajross 18y agoGmail serves its content via HTTPS, which isn't (statefully) proxyable or cachable by design. The explanation from Google makes no sense. If they're serving readable/unencrypted content to anything but the end user's web browser then they have a serious security flaw.
- bretthoerner 18y agoUnless you force it over to HTTPS or use an extension, it still uses plain ol' HTTP after authentication.
- mwerty 18y agoI never understood why that was. I use https://mail.google.com https://mail.google.com to login and it sticks with https.
- rufo 18y agoThat's what he means by "forcing it" - if you specifically type https://mail.google.com/ https://mail.google.com/ Gmail will encrypt the entire session; if you just go to http://mail.google.com/ http://mail.google.com/ or (more commonly) www.gmail.com it uses SSL for authentication, then switches you back to unencrypted HTTP for the rest of your session.
- deleted 18y ago[deleted]
- paul 18y agoHis screenshot clearly shows that he's accessing Gmail over HTTP http://neosmart.net/blog/wp-content/uploads/gmailsecurityleak.png http://neosmart.net/blog/wp-content/uploads/gmailsecuritylea...
- icey 18y agoIt's not really fair to you, but it's funny to see someone from the interwebs telling Paul how Gmail works.
- herdrick 18y agoI've had the same thing happen with Google calendar. (Later, randomly, I happened to meet socially the guy whose calendar I was mistakenly allowed to read. That was weird.)