Discussion on Google Secure Pro | Userscripts.org

Request, replied by Text

Text — Mon, 02 Nov 2009 08:24:56 +0000

I like the Google Secure Pro. Very functional. Very practical. Thanks for making it!

Is it supposed to secure Google search too? Because that just stays regular http.

I was hoping there was a way to force all google searches to use

httpS://www.google.com/search?q=
instead of the javascript its using now as
http://www.google.com/#hl=
I could just block javascript but then I couldn't use the auto suggestion feature on Google home page and the cursor doesn't automatically default to the text field.

Maybe this should be an entirely separate script. I don't know. Your call.

If you can do this, please let me know.
itsText (@) gmail {.} com

Optimizations, replied by Erik Vold

Erik Vold — Mon, 02 Nov 2009 00:04:46 +0000

JoeSimmons wrote:
Took out Regex (Regex is slow), put in substring

No you didn't, the substring is converted into a Regex which is used by replace(), this is slower I believe because the JS engine must convert the provided string into a regex before it can do it's work.

window.location.replace(url.replace(url.substring(0,7), 'https://'));

In the above the substring function needs to lookup 'http://' then 'http://' needs to be converted in to /http:\/\//

Here is what I suggest:
(function(){ var l=window.location; l.replace(l.href.replace(/^http:/, 'https:')); })();

using (function(){ ... })(); inside the userscript because some userscript clients may not have a safe scope for the variables we create. There may not be a need for this currently though..

No longer working in many countries, replied by contarc

contarc — Sun, 01 Nov 2009 15:21:30 +0000

Thank you for reporting this.

I am investigating it and will post further information.

Optimization, replied by contarc

contarc — Sun, 01 Nov 2009 15:16:37 +0000

Thanks for the suggestion. This has been implemented.

Optimization, replied by Bob3333

Bob3333 — Tue, 29 Sep 2009 06:20:06 +0000

Why reload the page if it's already SSL?

var url = window.location.href;

if (url.substring(0,7) == 'http://') {
window.location.replace(url.replace(url.substring(0,7), 'https://'));
}

No longer working in many countries, replied by Chris4

Chris4 — Wed, 12 Aug 2009 04:18:08 +0000

It appears that HTTPS is no longer accepted with many Google URLs.

The error message is "This Connection is Untrusted" (screenshot below).

I first experienced it on Google Reader (UK) and then I tested normal Google (UK), both of which came up the error.

I noticed that .com worked fine, but tested other country URLS such as: .bg, .jp, .si, .se, etc. and found that they don't work with HTTPS either.

International TLDs, replied by contarc

contarc — Tue, 19 May 2009 14:29:45 +0000

Thanks for the suggestion. This has been implemented.

Optimizations, replied by contarc

contarc — Tue, 19 May 2009 14:29:00 +0000

Thanks for the suggestion. This has been implemented.

International TLDs, replied by traknar

traknar — Mon, 18 May 2009 12:04:53 +0000

Hi,

Could you please replace the .com TLD by the generic one which works for all TLDs?

http://www.google.tld/webmasters/*
http://www.google.tld/notebook/*
http://knol.google.tld/*
http://sites.google.tld/*
http://groups.google.tld/*
http://www.google.tld/history/*
http://www.google.tld/bookmarks/*
http://www.google.tld/reader/*
http://spreadsheets.google.tld/*
http://docs.google.tld/*
http://www.google.tld/calendar/*
http://mail.google.tld/*

Thanks.

Optimizations, replied by JoeSimmons

JoeSimmons — Mon, 18 May 2009 00:25:37 +0000

Optimizations

Used top scope object to stop reduce scope chain (window.location.href)
Used .replace so the http url isn't in the history, only the https url
Took out Regex (Regex is slow), put in substring
Used variable to quicken substring and lookup

var url = window.location.href;
window.location.replace(url.replace(url.substring(0,7), 'https://'));

Archived Comments, replied by Master of Puppets

Master of Puppets — Sat, 02 Aug 2008 17:29:42 +0000

Yes, Google goofed on that:)

Archived Comments, replied by contarc

contarc — Fri, 25 Jul 2008 17:04:01 +0000

http://gmailblog.blogspot.com/2008/07/making-se...

Google finally adds 'always use https' option to Gmail.

Archived Comments, replied by contarc

contarc — Thu, 24 Jul 2008 23:33:02 +0000

FF3user: Here is a thread addressing your question. http://bytes.com/forum/thread148000.html Basically it boils down to it being implied when you do not specify 'window'.

Differences between Google Secure and Google Secure Pro:

Google Secure forces SSL on
https://www.google.com/accounts/*
https://www.google.com/a/*
http://mail.google.com/a/*.

Google Secure Pro forces SSL on
http://mail.google.com/*
http://www.google.com/calendar/*
http://docs.google.com/*
http://spreadsheets.google.com/*
http://www.google.com/reader/*
http://www.google.com/bookmarks/*
http://www.google.com/history/*
http://groups.google.com/*
http://sites.google.com/*

I do not include google.com/accounts because this page is already SSL forced. Same with google.com/health.

No idea why Google doesn't force Gmail to use this by default. It's just plain silly on their part.

Archived Comments, replied by FF3user

FF3user — Wed, 11 Jun 2008 20:43:20 +0000

Hey...
What difference does it do, not having 'window' in the code like your script doesn't?:
location.href = location.href.replace(/^http:/, 'https:');
Contrary to this:
window.location.href = window.location.href.replace(/^http:/, 'https:');
Like the http://userscripts.org/scripts/show/8311 'Google Secure' script have.

And what is the difference between your script and this script: http://userscripts.org/scripts/show/26175 'Secure GMail'?

Also: Why doesn't Gmail do this by default? Why not use https all the time? there must be a reason?

Archived Comments, replied by LilJonny53

LilJonny53 — Tue, 01 Apr 2008 03:04:31 +0000

very nice (note: be sure to adjust other scripts, that you may have installed, that apply to the Google service affected by this script, so the scripts continue to work correctly with the change in security configuration)

Archived Comments, replied by gabedibble

gabedibble — Sun, 08 Apr 2007 21:40:18 +0000

Author: Please check out User Script Updates - simply update the header of your script and your users will be able to receive change-notification when you improve this script

Archived Comments, replied by Jesse Andrews

Jesse Andrews — Wed, 17 Nov 2004 01:06:05 +0000

The following is an archive of comments made before threaded discussions was implemented (November 16th, 2008)