On Aug 19, 3:29 pm, scottDA wrote:
Sure. I think it is a little bizarre to describe this as some kind of
amazing discovery. Anyone familiar with web application security knows
that unencrypted sessions can be stolen.
Two things make this less-than-hugely dangerous:
1. The attacker needs to be on the physical network between you and
google. A random hacker in Russia can't do this.
2. They can only control your account for as long as the session
cookie is valid. If you log out or if the session expires, they lose
all access. And they won't be able to steal your password to get
permanent access.
Of course, temporary access is enough for them to do substantial
damage. So you really should use the always-secure feature. But most
people accessing gmail should be much more worried about spyware and
phishing emails than about man-in-the-middle attacks.
