>The assumption he implicitly makes is that Google is not going to do anything malicious with his password, and has a secure enough network. If you take this as

>The assumption he implicitly makes is that Google is not going to do anything malicious with his password, and has a secure enough network. If you take this assumption to be true, then his practice of emailing himself private information (over SSL, you can't access gmail without it), is reasonable. No it's not. First, it's does have to be Google to do something malicious with your mail. An exploit, e.g XSS, could be found for Gmail any day --there were several in the past. Second, was does "has a secure enough network" means? Does he only ever log on to Gmail from one network? The assumption of "secure enough network" and the words "hacker-proof" do no go together well.