Sure you can.
The easy way
First, deny the usage of all https service, which disables Google's HTTPS feature (including login and HTTPS access to GMAIL).
Second, capture all the traffic from/to GMAIL using ordinary HTTP port (80), and the data are not encrypted any more. It's bloody easy to get all the GMAIL addresses in plain text.
The hard way
Use a so-called HTTPS relay.
Technically it will break an HTTPS connection into two HTTPS connection,
GMAIL <--> HTTPS relay <--> Client
The traffic between gmail and relay, and between client and relay are through ordinary encrypted HTTPS connections, but actually traffic from client to https relay are encrypted by HTTPS relay's key, so HTTPS relay can read the actual message, and are able to record it.
The problem of this method is when clients' browser is trying to validate GMAIL's sign, users will get a warning saying it is not a valid sign or so. To crack this problem, you have to ask users to import your fraud CA's certificate. However, ordinary users just ignore the warnings.
BTW, before doing this, you and your company should be aware that these are against privacy law. And you should double check that your boss gives you written order to do so. |
发表于 14-10-2009 09:17:45
收藏
赞
踩
楼主
