23

As simple as that, when I'm using the official Gmail app to access my email account, does it use a secure connection?

Improve this question
1
  • I don't believe the Gmail app is using http at all.
    – ale
    Jan 18, 2011 at 18:15

3 Answers 3

Reset to default
9

One should be careful to differentiate between the gmail app, and the default mail client.

Gmail App

The Gmail app is the pre-installed app created by Google that can only be used with Gmail. The answer to whether or not the Gmail app is secure requires some understanding of Android app security. This passage from the dev guide explains how developers may connect to an SSL Socket to securely send TCP/IP communications.

Since the Gmail app uses SSL Sockets when sending and receiving mail, all communications are secure [citation needed].

Mail Client

Unlike the Gmail app, the default mail client can be used with any email account, including Gmail. When using this client to send and receive Gmail, an SSL connection must be used. The app is therefore also secure. Google explains how to do this in their help pages.

Improve this answer
2
  • This answer keeps bugging me. I'm making it community wiki b/c only a gmail app developer or someone who can watch smtp traffic on their phone could verify that the gmail app uses secure sockets.
    – Brett
    Feb 10, 2011 at 18:24
  • Honestly, the reason 'Gmail uses SSL Socket because Android API provides it' doesn't really sound convincing. But I don't have any data to counter-proof.
    – Andrew T. ♦
    Nov 2, 2015 at 1:07
10

According to this Google page the Android Gmail app uses an SSL connection in both directions.

Improve this answer
3
  • 3
    The OP asked about the gmail app; the linked page refers to the mail client.
    – Brett
    Feb 8, 2011 at 1:32
  • Huh, didn't notice the difference when I found the page, but it does say "Email" App as opposed to "Gmail" app.
    – LeoB
    Feb 11, 2011 at 13:14
  • 1
    The page you linked to only says that the Email app can be configured to retrieve Gmail securely, and details how to do it. It doesn't mean the Email app is necessarily set up that way on a user's device. And as @Brett pointed out, it doesn't say anything about the totally separate dedicated GMail app at all.
    – Joshua Carmody
    Dec 30, 2011 at 19:33
0

I don't believe that it does use SSL, but my evidence is circumstantial/anecdotal.

Yesterday I connected to a public WiFi from my Nexus 7. The native Gmail client successfully retrieved mail (on two accounts), but when I went to open a Google website through Chrome, I got the "The site's security certificate is not trusted!" message. Chrome for Android wouldn't give me any more details (what the specific problem was), but it seems to me that if the SSL connection wasn't good enough for Chrome, it shouldn't have been good enough for the Gmail app either. Ergo, either Gmail doesn't use SSL, or it doesn't use it securely (which amounts to the same thing).

I'd welcome another explanation, but based on the above, I changed the passwords on both those accounts immediately after.

Improve this answer
1
  • This shows nothing. Public Wi-Fi portal that uses a nag screen sometimes only intercepts HTTP for its nag screen
    – Lie Ryan
    Oct 17, 2013 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .