Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

How do I log into or use Gmail without having to go through the HTTPS or SSL version?

Since the 443 ports for HTTPS is filtered in Iran, is there any alternative method of logging into Gmail which does not require the use of this port?

share|improve this question
add comment

migrated from superuser.com Nov 30 '11 at 3:51

This question came from our site for computer enthusiasts and power users.

6 Answers

up vote 9 down vote accepted

First of all:

  • If the filtering is really only based on port numbers, then things are quite easily, and securely solved by using the official HTTPS URL via Tor, or via a proxy server (in another country) that supports "CONNECT" for SSL requests. For such proxies the SSL data is transferred over the port the proxy operates on (like often 81, 3128, 8080, 8181, 9090), not on the default HTTPS port 443.

    (For whoever wants to set up a proxy to help fight censorship: see for example Create anonymous Squid proxy for Iranian election protestors. The good thing about that article is that apparently, in June, communications through proxies were indeed not blocked? Or is nobody using HTTPS through those proxies?)

  • Unfortunately, filtering is probably based on protocol, not on port numbers. Tools like Wireshark show how easily SSL traffic is detected, even when running through non-default ports. (Use display filter "ssl", and see what port is used in the TCP data. Or, when using a proxy, use display filter "tcp.port eq 443" and see nothing is found.)

  • Some web based anonymising proxies support HTTPS over HTTP. For example: Hide My Ass Gmail proxy uses only HTTP. Of course, both a censor and the folks operating the proxy can peek into the communications.

  • Some project called Haystack was introduced (and withdrawn) in 2010:

    Haystack is a new program to provide unfiltered internet access to the people of Iran. A software package for Windows, Mac and Unix systems, called Haystack, specifically targets the Iranian government’s web filtering mechanisms.

    Similar to Freegate, the program directed against China’s “great firewall,” once installed Haystack will provide completely uncensored access to the internet in Iran while simultaneously protecting the user’s identity. No more Facebook blocks, no more government warning pages when you try to load Twitter, just unfiltered Internet.

    Which compared itself to Tor:

    Tor focuses on using onion routing to ensure that a user's communications cannot be traced back to him or her, and only focuses on evading filters as a secondary goal. Because Tor uses standard SSL protocols, it is relatively easily to detect and block, especially during periods when the authorities are willing to intercept all encrypted traffic.

    On the other hand, Haystack focuses on being unblockable and innocuous while simultaneously protecting the privacy of our users. We do not employ onion routing, though our proxy system does provide a limited form of the same benefit.

    Bad security holes though:

    Then in Sept. 2010, security experts discovered a problem: Iranian authorities, the very ones Haystack was supposed to circumvent and shield against, were exploiting massive holes in the encryption scheme to snoop on dissidents.

When all does get filtered or is otherwise unavailable, then maybe your only hopes are someone outside the country who can run a HTTP-to-HTTPS gateway, using for example DeleGate. Again, the censoring government (and whoever is running that DeleGate server) can then monitor all your traffic. (Google might be smart enough to hash your password, even when Google thinks you're using HTTPS. Still, even if the password is secure, then all other text can still be read, and cookies can probably be stolen.)


NOTE: the following does not work (yet?). I can show the Gmail login page, but after logging in, the many redirects (from gmail.com to www.google.com/accounts, to mail.google.com) confuse DeleGate. Maybe some smart MOUNT or some entries in hosts are required after all. Maybe it can put someone on the right track tough (if no easier solutions are found, like: ensure that does not work!).


See Force web address to go through https for a full explanation on mapping http://twitter.com to https://twitter.com. For a generic HTTP to HTTPS gateway, the command would not include the Twitter-specific MOUNT parameter, so:

sudo ./macosxi-dg -v -P80,443 SERVER=http RESOLV=cache,dns \
  STLS=-fcl,fsv:https ADMIN=a@b.c

No need for adjustments in hosts either; instead you can then use URLs like:

http://127.0.0.1/-_-https://www.google.com

(Where 127.0.0.1 needs to be replaced with the IP address of the DeleGate server.)

(Hmmm, if no easier solutions are posted then I might see if I can set up something like the above.)

share|improve this answer
    
Hmmm, this work in progress accepted as the best answer...? Feel free to react to the questions in the comments, so we can find the PERFECT solution... (And, above all: feel free to mark another answer as accepted if a real solution comes in...!) –  Arjan Sep 21 '09 at 17:26
add comment

Tor is made for exactly this situation. It can absolutely support SSL connections (you should not login to anything over Tor without SSL - otherwise you are giving your authentication details to completely unknown people, for example..)

You can use Privoxy to send SSL connections via Tor, http://www.privoxy.org/user-manual/startup.html explains this:

Before launching Privoxy for the first time, you will want to configure your browser(s) to use Privoxy as a HTTP and HTTPS (SSL) proxy. The default is 127.0.0.1 (or localhost) for the proxy address, and port 8118 (earlier versions used port 8000). This is the one configuration step that must be done!

Proxy Configuration Showing Mozilla/Netscape HTTP and HTTPS (SSL) Settings

One possible alternative, can you use IMAP over SSL (port 995)?

http://mail.google.com/support/bin/answer.py?hl=en&answer=13287

  • Incoming Mail (POP3) Server - requires SSL: pop.gmail.com
  • Use SSL: Yes
  • Port: 995
  • Outgoing Mail (SMTP) Server - requires TLS: smtp.gmail.com (use authentication)
  • Use Authentication: Yes
  • Use STARTTLS: Yes (some clients call this SSL)
  • Port: 465 or 587
  • Account Name: your full email address (including @gmail.com or @your_domain.com)
  • Email Address: your email address (username@gmail.com or username@your_domain.com)
  • Password: your Gmail password
share|improve this answer
    
Great link to that article in The Register! Apparently even the Iranian embassy was (or is) using Tor...? theregister.co.uk/2007/09/10/… –  Arjan Sep 20 '09 at 15:46
add comment

Have you thought about an anonymizing proxy like Tor? This way, the filter would not work. Unless, of course, Tor is also blocked. But please only use encrypted protocols (e.g. like the mentioned HTTPS) over Tor.

share|improve this answer
    
When i use an anonymizing proxy like Tor also cant use https –  SjB Sep 18 '09 at 22:01
    
SjB: Tor itself doesn't block HTTPS, and with it your country's ISPs cannot see you're using HTTPS either. So I don't see why wouldn't it work (assuming Tor itself is not blocked). –  grawity Sep 19 '09 at 12:33
    
@SjB, so did you actually try Tor, and succeeded in using it for non-Gmail URLs? If so, then indeed your problem should be solved, and Gmail over HTTPS via Tor should really also work. (Unless the exit node happens to be in Iran as well, so you might need to ignore Iranian nodes. Or unless your government somehow routes the whole list of Tor nodes to their own servers, but that would then break the "onion key", so your client would not connect to such node?) –  Arjan Sep 20 '09 at 15:49
add comment

Use Opera Mini, assuming it's not been blocked again. If you're on PC, you can try MicroEmulator to run Mini.

share|improve this answer
    
I think it might work, because opera mini uses port 8080, which should not be blocked. the connection between opera mini and opera server is encrypted –  Tutul Sep 19 '09 at 8:43
    
Yes, and Mini is quite happy with secure sites. You're likely to lose a little bit of functionality of course. –  CodeByMoonlight Sep 19 '09 at 9:19
add comment

Have you tried using tor? If it's not blocked yet then you can login to Gmail using tor and change gmail settings. In that case, you should use GPG for encrypting your mails.

Alternatively, you can get a shell account (assuming port22 is not blocked), and tunnel over it port 443, so you can login to Gmail.

share|improve this answer
    
You should not disable GMail's SSL if you are using Tor.. Doing so is basically giving your authentication details to random people (those running the Tor exit nodes) –  dbr Sep 19 '09 at 13:05
    
And, if Tor is allowed, then there would be no need to disable Gmail's SSL to start with. (Also, like meanwhile mentioned in other comments: regardless that SSL setting, Gmail still requires HTTPS during login. So, that specific Gmail setting is not useful in this case.) –  Arjan Sep 20 '09 at 7:55
add comment

If the Iranian governments blocks SSL, they connecting without SSL results probably in some government server logging your password. If you connect without SSL you should be aware that they are probably reading your mail.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.