Penetration testing blog

I went crazy yesterday looking for a tool that would easily let me remove every single e-mail from my Gmail account. I really find it hard to believe that even though I get the “E-mails deleted” message, they are not being kept somewhere for some agency’s convenience. Nonetheless, I wanted to take a measure of removing everything and quickly (I don’t have anything to hide really, it’s just for learning!.)

By quickly I mean that if you have thousands of e-mail conversations, the largest amount of e-mails/threads that you could list within Gmail are 100. Therefore an hour clicking select-all and delete would have been incredibly insane.

I started googling. I found a script in perl that some guy wrote which simply connected to Gmail’s IMAP service and looped through the threads removing everything with IMAP commands.

Then I found a series of threads about people trying to do the same thing, which is automating the e-mail deletion process, and a discussion on how certain Firefox GreaseMonkey (http://www.greasespot.net/) plugins could fake your button clicks, pretty much like a single sign on session.

I also found python libraries from 2005, nothing really convincing.

That is when I went back to the Gmail interface and selected all 100 threads on screen, and all of a sudden this amazing “Select all 4015 conversations in Inbox” link appeared! It had already been implemented by Gmail, stupid me trying to look somewhere else for the response!

Clicking on that link provided me with a way of selecting everything I had in my Inbox, then again on my Sent e-mails and by clicking on the Delete button I moved everything to the Trash. You then have to go to the Trash and delete everything forever.

Hope that saves you some time!

I’ve been looking around certain Gmail topics, including how to wipe out everything from your Inbox (I will talk about that in my next post) and one of the things I was interested in was ’security’.

If you are a gmail user and you are a firefox user, then consider taking a look at customizegoogle.com

I’m not affiliated with that site by any means, and I dislike the fact that it looks more commercial than good, but the reality is that along with their promises of being spyware-free, it really does a good job when it comes to protecting your communication with gmail.

Included with that firefox plugin are lots of other features, such as disabling google ads while you search @ google or while you’re inside gmail. But the one I care the most is a feature that forces SSL everytime you surf your mail @ gmail.

Why do you need that? Simple. Head your browser to www.gmail.com - you will find that you are automatically redirected to the SECURE version, yes. However, the point of that is for protecting your username and password while logging in (otherwise it would be sent in plaintext through the network)

The problem starts right after you have logged in. You will notice that you’re no longer in a secure version under SSL but rather back to the standard http:// protocol. You can switch back to the secure version manually, that is, by modifying the Url and adding that extra ’s’ after http, making it https:// - However once is ok, twice.. fine, but three times, or every single time you log into gmail remembering to switch back to the secure version is a freaking pain in the behind. Not to mention that once you’ve realized you are in the insecure version, your e-mail headers (that e-mail list with extracts from the e-mails you received) have already been sent plaintext to you.

If you add to that my other post where I mention FireGPG and GPG4Win (http://www.penetrationtests.com/blog/2008/05/07/it-looks-like-the-gpgfirefoxwindowsgmail-puzzle-is-solved/) then you have plenty of security added to the default gmail package.

Check it out, it’s worth it!

Good luck.