How in the Tech

Secure Gmail Access 24/7

By Adam Myers ⋅ March 10, 2009 ⋅ Tags: Gmail, Security

I was a late holdover to the phenomenon of a free web-based email service. When Hotmail and Yahoo Mail really started gaining traction webmail was pretty slow and cumbersome compared to the experience of a traditional desktop email client – no surprise really. Any email power-user would quickly lose their patience if they were forced to use webmail for all of their correspondence. While I was never a heavy email user I still clung to my desktop email software nonetheless.

When Google decided to enter the webmail ring to the tune of a free service with an unheard of 1GB email quota – most of the others offered as little as a few MBs – it was time to begin rethinking my allegiance. Without belaboring this further, Google Gmail allowed me to consolidate all of my Inboxes into one view, while having acceptable performance, fantastic search, and access from anywhere with a PC.

While Google hasn’t yet claimed the #1 spot for webmail, it has without question changed the landscape and raised the bar. The notion of having an email quota is now laughable. Another unique, at the time, was the offering of webmail fully over an https connection – that is a secure and encrypted connection from your PC to Gmail. While Hotmail and Yahoo offered an encrypted session for your login, after a successful login you were redirected back over to the non-secure http connection. Theoretically, if you accessed your Hotmail account from a public network other computers on that network could also see your unencrypted webmail session and thus read your email. While not a trivial process, is it something you really want to take a chance with?

The only downside of Google’s initial offering was that the user would have to actively point their browser to https://mail.google.com to initiate the full encrypted session. Even though this was available with minimal manual effort, Google eventually decided to take it a step further and offer it as a Preference option from within Gmail – Always use HTTPS. Unfortunately, it is defaulted to off. Why? Well, SSL encrypted connections offer increased overhead on the servers handling the encryption and decryption. When you are offering a free service you tend to want to maximize the amount of users while dedicated the least amount of hardware.

All that being said, you really want to be using https.

1. From within Gmail click the Settings link at the top right of your screen.



2. From the General tab scroll to the bottom of the screen to Browser connection.



3. Here you should select the radio button next to Always use HTTPS. Lastly, click the Save Changes button to apply the setting.