What School Never Taught You About The Waterfall Method

Everyone loves
Google. They want to be everything to everyone, and they’re getting pretty damn
good at it. Once you start using their services it gets easier and easier to
migrate more of your life to them. But there’s a slight problem.

Google, like most other similar services, encrypts login traffic
but not your content.
So the moment you’re signed in they switch to plain-text communications
and send everything to you in the open.

This means your mail, the news sources you read, your calendar events — are
all able to be read by someone with access to any part of the network
between you and Google. This could be your employer at work, the wireless
network at your local coffee shop, whatever. This isn’t good.

Here’s an email I just sent myself over the default (unencrypted)
connection:

tcpdump

1. Use Bookmarks for Your Google ServicesCreate bookmarks (or modify
   them if you already have them) for
   Gmail,
   Google Calendar,
   Google Reader, and
   iGoogle
   (your Google homepage) using https instead of
   http, like so: https://mail.google.com/mail/.
   Do this for every service that you use at Google.

2. Don’t Click on Links Within Google to Take You to Your ServicesIf
   you use their links Google will often take you to the unencrypted
   version because it’s easier on their servers. Use your links instead to
   ensure that your sessions are encrypted

The more we depend on Google (or any other monolithic service) the more we
need to safeguard the information they have of ours. One way we can help is
by demanding (via secure bookmarks and other methods) that they send us our
mail, news feeds, calendars, and other information over a secure
connection.:

[ Note: This is not a Google-specific problem. Most other services
work in exactly the same way. The difference is that Google is so prolific
and is becoming very successfully at getting people to use not only their
email service but also their calendaring, news reader, instant messaging,
their search (with history), etc. It’s the all-in-one dynamic that makes it
especially important to protect Google traffic. ]