Security researchers ask Google to enable SSL encryption by default

A group of 38 researchers and privacy advocates sent a letter to Google asking it to enable SSL encryption by default in all its applications. Google has had the always-use-SSL option for a while but, since the feature is disabled by default, only a small number of users is taking advantage of it. Google's response was somewhere along the lines of "we'll give the users security... eventually... if we must".

Although the performance overhead of SSL is negligible for most web sites, the price of security is likely to be significant in Google's case, considering the size of its user base.

Comments

[joe]

So why did you sign the letter? Are you planning to help subsidize the cost?

Also, why wasn't a letter sent to the web mail providers who are doing less? I don't understand.

[Ivan Ristić]

Joe,

I didn't sign the letter. You should ask those who did.

[Joe]

Sorry, I thought I saw your name on it. My mistake.