Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? 

Some have criticized Google for being Evil by forcing them into a secure connection even if they don't want to be secure. They argue that if it's just their own account, shouldn't they be the only one to decide whether or not to secure themselves?

Note: This question was posted in reference to the article linked above in order to provide a canonical answer to the question being asked off-site (which is why it was answered by the same person who asked it).


It's not just about you. By forcing users to use TLS, they're creating a more secure environment for everyone.

Without TLS being strictly enforced, users are susceptible to attacks such as sslstrip. Essentially, making unencrypted connections an option leads to the possibility of attackers forcing users into unencrypted connections.

But that's not all. Requiring TLS is the first step in moving toward HSTS enforcement on the google.com domain. Google already does opportunistic HSTS enforcement -- which is to say that they don't require TLS, but they do restrict which certificates are allowed to be used on Google.com (nb: this technique is now called HPKP). That's an improvement, but it's not ultimately a solution.

For full HSTS enforcement, they need to ensure that requiring TLS on all Google services within the domain won't break any necessarily third-party solutions. Once enforcement is turned on, it can't easily be turned off. So by moving services one-by-one to strict TLS enforcement, they are paving the way toward making HSTS enforcement across the domain a reality.

Once this enforcement is in place, browsers will simply refuse to connect to Google over an insecure or compromised connection. By shipping this setting in the browser itself, circumvention will become effectively impossible.


  Disclaimer: I work for Google now but I didn't work for Google when I wrote this. This is my opinion, not Google's (as should be immediately clear to anyone with a basic understanding of chronology).

