Security

At one time Gmail used an unencrypted connection to retrieve user data, encrypting only the connection used for the login page. However, by replacing the URL http://mail.google.com/mail/ with https://mail.google.com/mail/, users were able to force Gmail to use a secure connection, reducing the risk of third-party eavesdropping on user information, such as emails and contacts, which are transmitted in plaintext as JavaScript data in the page source code. Starting in July 2008, it was possible to configure Gmail for HTTPS access only through the Settings - this prevented any insecure access via HTTP. POP3 and IMAP access uses Transport Layer Security, or TLS. At present Gmail now defaults to a secure HTTPS connection.