Log into Gmail without SSL

Question

How do I log into or use Gmail without having to go through the HTTPS or SSL version?

Since the 443 ports for HTTPS is filtered in Iran, is there any alternative method of logging into Gmail which does not require the use of this port?

Answer 1

First of all:

• If the filtering is really only based on port numbers, then things are quite easily, and securely solved by using the official HTTPS URL via Tor, or via a proxy server (in another country) that supports "CONNECT" for SSL requests. For such proxies the SSL data is transferred over the port the proxy operates on (like often 81, 3128, 8080, 8181, 9090), not on the default HTTPS port 443.

  (For whoever wants to set up a proxy to help fight censorship: see for example Create anonymous Squid proxy for Iranian election protestors. The good thing about that article is that apparently, in June, communications through proxies were indeed not blocked? Or is nobody using HTTPS through those proxies?)

• Unfortunately, filtering is probably based on protocol, not on port numbers. Tools like Wireshark show how easily SSL traffic is detected, even when running through non-default ports. (Use display filter "ssl", and see what port is used in the TCP data. Or, when using a proxy, use display filter "tcp.port eq 443" and see nothing is found.)

• Some web based anonymising proxies support HTTPS over HTTP. For example: Hide My Ass Gmail proxy uses only HTTP. Of course, both a censor and the folks operating the proxy can peek into the communications.

• Some project called Haystack was introduced (and withdrawn) in 2010:

  Haystack is a new program to provide unfiltered internet access to the people of Iran. A software package for Windows, Mac and Unix systems, called Haystack, specifically targets the Iranian government’s web filtering mechanisms.

  Similar to Freegate, the program directed against China’s “great firewall,” once installed Haystack will provide completely uncensored access to the internet in Iran while simultaneously protecting the user’s identity. No more Facebook blocks, no more government warning pages when you try to load Twitter, just unfiltered Internet.

  Which compared itself to Tor:

  Tor focuses on using onion routing to ensure that a user's communications cannot be traced back to him or her, and only focuses on evading filters as a secondary goal. Because Tor uses standard SSL protocols, it is relatively easily to detect and block, especially during periods when the authorities are willing to intercept all encrypted traffic.

  On the other hand, Haystack focuses on being unblockable and innocuous while simultaneously protecting the privacy of our users. We do not employ onion routing, though our proxy system does provide a limited form of the same benefit.

  Bad security holes though:

  Then in Sept. 2010, security experts discovered a problem: Iranian authorities, the very ones Haystack was supposed to circumvent and shield against, were exploiting massive holes in the encryption scheme to snoop on dissidents.

When all does get filtered or is otherwise unavailable, then maybe your only hopes are someone outside the country who can run a HTTP-to-HTTPS gateway, using for example DeleGate. Again, the censoring government (and whoever is running that DeleGate server) can then monitor all your traffic. (Google might be smart enough to hash your password, even when Google thinks you're using HTTPS. Still, even if the password is secure, then all other text can still be read, and cookies can probably be stolen.)

---

NOTE: the following does not work (yet?). I can show the Gmail login page, but after logging in, the many redirects (from gmail.com to www.google.com/accounts, to mail.google.com) confuse DeleGate. Maybe some smart MOUNT or some entries in hosts are required after all. Maybe it can put someone on the right track tough (if no easier solutions are found, like: ensure that does not work!).

---

See Force web address to go through https for a full explanation on mapping http://twitter.com to https://twitter.com. For a generic HTTP to HTTPS gateway, the command would not include the Twitter-specific MOUNT parameter, so:

sudo ./macosxi-dg -v -P80,443 SERVER=http RESOLV=cache,dns \
  STLS=-fcl,fsv:https ADMIN=a@b.c

No need for adjustments in hosts either; instead you can then use URLs like:

http://127.0.0.1/-_-https://www.google.com

(Where 127.0.0.1 needs to be replaced with the IP address of the DeleGate server.)

(Hmmm, if no easier solutions are posted then I might see if I can set up something like the above.)

Answer 2

Tor is made for exactly this situation. It can absolutely support SSL connections (you should not login to anything over Tor without SSL - otherwise you are giving your authentication details to completely unknown people, for example..)

You can use Privoxy to send SSL connections via Tor, http://www.privoxy.org/user-manual/startup.html explains this:

Before launching Privoxy for the first time, you will want to configure your browser(s) to use Privoxy as a HTTP and HTTPS (SSL) proxy. The default is 127.0.0.1 (or localhost) for the proxy address, and port 8118 (earlier versions used port 8000). This is the one configuration step that must be done!

One possible alternative, can you use IMAP over SSL (port 995)?

http://mail.google.com/support/bin/answer.py?hl=en&answer=13287

• Incoming Mail (POP3) Server - requires SSL: pop.gmail.com
• Use SSL: Yes
• Port: 995
• Outgoing Mail (SMTP) Server - requires TLS: smtp.gmail.com (use authentication)
• Use Authentication: Yes
• Use STARTTLS: Yes (some clients call this SSL)
• Port: 465 or 587
• Account Name: your full email address (including @gmail.com or @your_domain.com)
• Email Address: your email address (username@gmail.com or username@your_domain.com)
• Password: your Gmail password

Answer 3

Have you thought about an anonymizing proxy like Tor? This way, the filter would not work. Unless, of course, Tor is also blocked. But please only use encrypted protocols (e.g. like the mentioned HTTPS) over Tor.

Answer 4

Use Opera Mini, assuming it's not been blocked again. If you're on PC, you can try MicroEmulator to run Mini.

Answer 5

Have you tried using tor? If it's not blocked yet then you can login to Gmail using tor and change gmail settings. In that case, you should use GPG for encrypting your mails.

Alternatively, you can get a shell account (assuming port22 is not blocked), and tunnel over it port 443, so you can login to Gmail.

Answer 6

If the Iranian governments blocks SSL, they connecting without SSL results probably in some government server logging your password. If you connect without SSL you should be aware that they are probably reading your mail.