Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

As simple as that, when I'm using the official Gmail app to access my email account, does it use a secure connection?

share|improve this question
    
I don't believe the Gmail app is using http at all. –  Al E. Jan 18 '11 at 18:15
    
I rephrased it.. thank you –  pootzko Jan 18 '11 at 18:16

3 Answers 3

up vote 6 down vote accepted

One should be careful to differentiate between the gmail app, and the default mail client.

Gmail App

The gmail app is the pre-installed app created by Google that can only be used with gmail. The answer to whether or not the gmail app is secure requires some understanding of Android app security. This passage from the dev guide explains how developers may connect to an SSLSocket to securely send tcp/ip communications.

Since the gmail app uses SSLSockets when sending and receiving mail, all communications are secure [citation needed].

Mail Client

Unlike the gmail app, the default mail client can be used with any email account, including gmail. When using this client to send and receive gmail, an SSL connection must be used. The app is therefore also secure. Google explains how to do this in their help pages.

share|improve this answer
    
This answer keeps bugging me. I'm making it community wiki b/c only a gmail app developer or someone who can watch smtp traffic on their phone could verify that the gmail app uses secure sockets. –  Brett Feb 10 '11 at 18:24
    
yeah, it's like - there's nowhere an explicit answer to be found. guess it's time for wireshark :D –  pootzko Feb 10 '11 at 18:55

According to this Google page the Android Gmail app uses an SSL connection in both directions.

share|improve this answer
3  
The OP asked about the gmail app; the linked page refers to the mail client. –  Brett Feb 8 '11 at 1:32
    
Huh, didn't notice the difference when I found the page, but it does say "Email" App as opposed to "Gmail" app. –  LeoB Feb 11 '11 at 13:14
1  
The page you linked to only says that the Email app can be configured to retrieve Gmail securely, and details how to do it. It doesn't mean the Email app is necessarily set up that way on a user's device. And as @Brett pointed out, it doesn't say anything about the totally separate dedicated GMail app at all. –  Joshua Carmody Dec 30 '11 at 19:33

I don't believe that it does use SSL, but my evidence is circumstantial/anecdotal.

Yesterday I connected to a public WiFi from my Nexus 7. The native Gmail client successfully retrieved mail (on two accounts), but when I went to open a Google website through Chrome, I got the "The site's security certificate is not trusted!" message. Chrome for Android wouldn't give me any more details (what the specific problem was), but it seems to me that if the SSL connection wasn't good enough for Chrome, it shouldn't have been good enough for the Gmail app either. Ergo, either Gmail doesn't use SSL, or it doesn't use it securely (which amounts to the same thing).

I'd welcome another explanation, but based on the above, I changed the passwords on both those accounts immediately after.

share|improve this answer
    
This shows nothing. Public Wi-Fi portal that uses a nag screen sometimes only intercepts HTTP for its nag screen –  Lie Ryan Oct 17 '13 at 15:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.