3 ms·
This is kind of a dickish move on Google's part: you don't just suddendly do something like this, you notify in advance and give time for people to switch over.
by nodata 14y ago
This is kind of a dickish move on Google's part: you don't just suddendly do something like this, you notify in advance and give time for people to switch over.
StartSSL is on the Mozilla CA list, so it should work with gmail. They offer free certs:
https://www.startssl.com/?app=1 https://www.startssl.com/?app=1
Not tested yet.
- jessaustin 14y agoI kind of agree on the advance notice, but then again what excuse does anybody have anymore for not delivering IMAP over SSL? (If you're talking about a personal server, why not either a) forward to gmail or b) update your MX records to point at gmail?)
- nodata 14y agoThis isn't about SSL or not SSL, this is about self-signed SSL versus non self-signed SSL.
- Firehed 14y agoSure, but there's absolutely no way to differentiate between self signed SSL cert and a MITM attack.
- nodata 14y agoSure there is: just get the client to remember the cert.
- omh 14y agoHow do you handle things the first time? Perhaps you're always under a MITM attack. And what about when you change the certificate deliberately?
- kalleboo 14y ago> How do you handle things the first time? You compare the fingerprint.
- krisoft 14y agoCompare with what? Honest question, it seems to me self evident that there is nothing to compare to at first time, so maybe I'm mistaken. Would you mind to elaborate?
- nodata 14y agoYou have a fingerprint for your certificate on your server. Google connects to your server, and sees a fingerprint. If they are the same, you don't have a MITM.
- jessaustin 14y agoIs it any better for all affected users to have to 1) figure out what this fingerprint is and enter it and then 2) individually update the fingerprint every time the cert changes, after they figure out that's why they're not getting any email through this particular provider any more? Isn't it easier from Google's perspective to just say "you can't do this" than deal with those complications?
- nodata 14y agoYou're completely missing the point, but to answer your questions: 1. If you're self generating a cert, you know how to do it. 2. It doesn't change very often. This discussion is about Google making a change without warning that has an immediate negative impact on pre-existing users. This discussion is not about new pop3 accounts being added to Gmail.
- codeka 14y agoI agree it sucks that there was no warning, but why would you be using self-signed certificates in this situation anyway? There's almost no benefit at all and in fact all it really does it give you a false sense of security that your connection is "secure" when in fact it's not.
- est 14y ago> There's almost no benefit at all There is, a cert under a CA could be hijacked by MITM (another CA gone rogue), while if a client stores the self-signed cert, it will always be that cert, no exceptions.
- nodata 14y agoWhy use self-signed certs? It depends how the client (here Gmail) handles them. If it asks you to approve the cert, and remember the approval, you get exactly the same amount of security as a non-self signed cert. iirc this is what Gmail did.
- aw3c2 14y agoSure there is a benefit! Unless you specifically are being targetted with a MITM, your mail will be save and encrypted anywhere between your originating server and Google's receiving server. No ISP or government router traffic harvesting.
- icebraining 14y agoIf the government wants to harvest your traffic, MITM'ing is not really a great impediment. It might be an impediment for your ISP because of the economic constraint it imposes, but even that is not certain.
- aw3c2 14y agoAs I said, this is no precaution about targetted attacks. It works well against the default packet inspection and probably also storage routers (can) do.
- 14y ago
- michaelt 14y agoI agree advance notice would have been good - but accepting self-signed certs seems like a recipe for MITM attacks. If I ask Gmail to check my mail.outlook.com account and it gets a self-signed cert back, I'd certainly expect it to alert, not to send my credentials to the MITM.