Yesterday we had a discussion in Entornos about security when accessing your Gmail account, or anyone with HTTPS, alleging that any web application protected by encryption SSL is safe, and impossible to breach, especially with new double authentication. Nothing could be further from the truth.

An interesting tool is floating around the net called “Surf Jack”, which demonstrates a security flaw when accessing from unsecured locations. The proof-of-concept tool allows testers to steal session cookies on HTTP and HTTPS sites that do not set the secure flag. You can download the tool from here and a document with more details on the topic.