Discussion on Force HTTPS for GMail, GCal, and GDocs | Userscripts.org

Archived Comments, replied by Anmar Mansur

Anmar Mansur — Mon, 28 Apr 2008 09:28:33 +0000

Victor, granted your script works in more cases than my Force HTTPS for GMail, GCal, and GDocs script, but yours only modifies the protocol to secure HTTPS after the page has loaded in non-secure HTTP and the damage was already done.

In a man in the middle attack scenario, the attacker will obtain access to an authenticated session with your Google service of choice, while you unknowingly continue to use the service over HTTPS feeling (falsely) secure.

I strongly suggest you modify your script or take it down immediately.

Archived Comments, replied by Víctor Sánchez

Víctor Sánchez — Sun, 27 Apr 2008 18:46:34 +0000

Archived Comments, replied by Jonny

Jonny — Tue, 21 Aug 2007 14:53:58 +0000

Good script!

Archived Comments, replied by Jesse Andrews

Jesse Andrews — Wed, 17 Nov 2004 01:05:24 +0000

The following is an archive of comments made before threaded discussions was implemented (November 16th, 2008)