# gmail "Connection is untrusted"?? **URL:** \ **Category:** Factual Questions\ **Created:** [October 28, 2014, 2:47pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760 "2014-10-28T14:47:03Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![CC](https://avatars.discourse-cdn.com/v4/letter/c/f1d935/32.png) [@CC](https://boards.straightdope.com/u/CC)\ **Post date:** [October 28, 2014, 2:47pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/1 "2014-10-28T14:47:03Z")
I have set gmail as my home page in Firefox. Suddenly, when trying to access gmail, I am getting a message that says this is an Untrusted Connection and suggests “it could mean someone is trying to impersonate the site, and you shouldn’t continue.” It also says in the technical details that [mail.google.com](http://mail.google.com) uses an invalid security certificate (whatever the hell that means). So I ran CC cleaner and uninstalled, then reinstalled Firefox. Same message. I can get to gmail using Chrome, but I’d prefer using the Firefox browser. Any ideas what has caused this and how to remove the problem? ---
**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\ **Post date:** [October 28, 2014, 2:53pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/2 "2014-10-28T14:53:39Z")
I have the same problem with an old computer that still has Windows XP, and it gives the same message for Facebook. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 28, 2014, 2:55pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/3 "2014-10-28T14:55:12Z")
I can tell you what it means, but not why. There are certifying agencies that confirm that websites are who they claim to be. If you have a website that uses a secure connection, then you can get a certificate from one of these agencies, that you can show to anyone visiting your site so they can verify it. If a secure site lacks such a certificate, or if it has one but it’s out of date or otherwise invalid, then your browser will warn you, and you should be careful about giving them any sensitive information (passwords, credit card numbers, etc.). Now, usually, when this happens, it just means that somebody at the site got sloppy, and forgot to process their certificate renewal, or the like. But I have a hard time conceiving of Google being sloppy in this way. So, maybe someone really is impersonating Google? ---
**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\ **Post date:** [October 28, 2014, 2:58pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/4 "2014-10-28T14:58:10Z")
> [@Chronos](#): > > So, maybe someone really is impersonating Google? Same thing happens if I type in the addresses directly. ---
**Author:** ![Claverhouse](https://avatars.discourse-cdn.com/v4/letter/c/13edae/32.png) [@Claverhouse](https://boards.straightdope.com/u/Claverhouse)\ **Post date:** [October 28, 2014, 3:15pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/5 "2014-10-28T15:15:49Z")
Recently there has been a lot of kerfuffle and excitement, mostly panic-driven, over bugs in the certifications, not only the Open Source OpenSSL, as in Heartbleed, and earlier Apple’s implementation in Feb, but a few weeks ago in regular SSL ( Poodle bug ) — which can be a mixture of Closed and Open Source. So a lot of certificates were/are being revoked; and new ones purposed. It really prolly doesn’t matter in the long run. No-one’s in danger from regular websites, whether or not a certificate is there ( remember, most certificates are self-certificated by the web owner, which is basically just taking his word for the information provided, just as domain information is just taking the owner’s word for it’s accuracy. ) Financial sites are different and have a lot more safety measures. Hopefully. ---
**Author:** ![arseNal](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@arseNal](https://boards.straightdope.com/u/arseNal)\ **Post date:** [October 28, 2014, 3:27pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/6 "2014-10-28T15:27:56Z")
What OS/service pack? ---
**Author:** ![CC](https://avatars.discourse-cdn.com/v4/letter/c/f1d935/32.png) [@CC](https://boards.straightdope.com/u/CC)\ **Post date:** [October 28, 2014, 3:43pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/7 "2014-10-28T15:43:53Z")
It’s Windows 8. Don’t know about service pack. But why do I still have the problem when using Firefox but not Google? And how do I resolve it? In fact, I’ve just discovered that when I’m using Firefox, I can’t even get to Google search, because when I try to, I get the same message. WTF? ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [October 28, 2014, 3:48pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/8 "2014-10-28T15:48:35Z")
Here’s a thread on the Mozilla (Firefox) support forums about the issue: [https://support.mozilla.org/en-US/questions/999155](https://support.mozilla.org/en-US/questions/999155) ---
**Author:** ![CC](https://avatars.discourse-cdn.com/v4/letter/c/f1d935/32.png) [@CC](https://boards.straightdope.com/u/CC)\ **Post date:** [October 28, 2014, 4:05pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/9 "2014-10-28T16:05:54Z")
Yeah, well something is seriously screwed up. I clicked on the link (I’m using Firefox now), and got the same message. I copied/pasted the link into Chrome and looked at the article, which suggested clearing the cache and cookies, which I did. No difference. ---
**Author:** ![Punoqllads](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@Punoqllads](https://boards.straightdope.com/u/Punoqllads)\ **Post date:** [October 28, 2014, 4:30pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/10 "2014-10-28T16:30:11Z")
> [@Czarcasm](#): > > Same thing happens if I type in the addresses directly. For some attack vectors, this doesn’t matter. The address you type in gets turned into an Internet Protocol (IP) address by a Domain Name Service (DNS). In a DNS spoofing attack, the service translates the name into the IP address of a malicious site. ---
**Author:** ![Claverhouse](https://avatars.discourse-cdn.com/v4/letter/c/13edae/32.png) [@Claverhouse](https://boards.straightdope.com/u/Claverhouse)\ **Post date:** [October 28, 2014, 4:35pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/11 "2014-10-28T16:35:33Z")
> [@Chronos](#): > > Now, usually, when this happens, it just means that somebody at the site got sloppy, and forgot to process their certificate renewal, or the like. But I have a hard time conceiving of Google being sloppy in this way. So, maybe someone really is impersonating Google? Google has made a practice of forgetting stuff like this — as have others, particularly with domain renewals: it’s easily done. Here’s an **[instance](https://www.seroundtable.com/archives/017825.html)** from 6 years ago. Personally, I’d just click through the warnings. Particularly with Google Search. What are the bad guys gonna do ? Show you a bunch of dodgy adverts ? ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [October 28, 2014, 7:29pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/12 "2014-10-28T19:29:06Z")
> [@CC](#): > > Yeah, well something is seriously screwed up. I clicked on the link (I’m using Firefox now), and got the same message. I copied/pasted the link into Chrome and looked at the article, which suggested clearing the cache and cookies, which I did. No difference. Do you have Kapersky installed? Or does that bit not apply? ---
**Author:** ![CC](https://avatars.discourse-cdn.com/v4/letter/c/f1d935/32.png) [@CC](https://boards.straightdope.com/u/CC)\ **Post date:** [October 28, 2014, 7:34pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/13 "2014-10-28T19:34:29Z")
nope. And I’d like to fix this, since, strangely enough, g-mail works better with Firefox than with Chrome. ---
**Author:** ![Claverhouse](https://avatars.discourse-cdn.com/v4/letter/c/13edae/32.png) [@Claverhouse](https://boards.straightdope.com/u/Claverhouse)\ **Post date:** [October 28, 2014, 7:42pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/14 "2014-10-28T19:42:58Z")
Another thing check your computer time: not only the operating system time, but the one in the BIOS run by CMOS, which is separate. If the browser notices a difference which suggests either the computer or the certificate is in the past, this can affect whether or not it accepts the certificate. Anyway, due to the crazy expiration system for domains etc., I hate to imagine how many domains and certificates a mega-giant has to watch: perhaps they have people whose _sole_ job it is to renew timely. Preferably monitored with computer assistance. ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [October 28, 2014, 7:50pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/15 "2014-10-28T19:50:28Z")
When you re-installed Firefox did you connect your original profile or did you start with a new profile? When you go to gmail, or any other site that throws this error, have you been able to look at the certificate? You can click on the icon in your address bar to the left of the address. Or right-click on the page “View Page Info” and go to Security. Does it look like the certificate is valid? Is it saying the cert belongs to google or does it say something else? ---
**Author:** ![CC](https://avatars.discourse-cdn.com/v4/letter/c/f1d935/32.png) [@CC](https://boards.straightdope.com/u/CC)\ **Post date:** [October 28, 2014, 8:21pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/16 "2014-10-28T20:21:06Z")
No - I didn’t use a new profile. I did look at what I think are the certificates, using page view - the connection tab tells me that the website has been verified by (amazingly) DO\_NOT\_TRUST\_fiddlerroot. But I’m going to that website via Chrome. I can’t get there via Firefox, so I can’t see what might be different. ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [October 28, 2014, 8:37pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/17 "2014-10-28T20:37:33Z")
Your network connection has been hijacked. [https://support.mozilla.org/en-US/questions/994422](https://support.mozilla.org/en-US/questions/994422) ---
**Author:** ![CC](https://avatars.discourse-cdn.com/v4/letter/c/f1d935/32.png) [@CC](https://boards.straightdope.com/u/CC)\ **Post date:** [October 28, 2014, 8:57pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/18 "2014-10-28T20:57:22Z")
As a matter of fact, that’s what happened. I went to the control panel to look at the programs I have, and since I have very few, I was able to spot the interloper right away. Uninstalled it and, Bingo!, back in business. Grateful Doper here. xo, C. ---
**Author:** ![arseNal](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@arseNal](https://boards.straightdope.com/u/arseNal)\ **Post date:** [October 28, 2014, 9:03pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/19 "2014-10-28T21:03:25Z")
What was the program? ---
**Author:** ![CC](https://avatars.discourse-cdn.com/v4/letter/c/f1d935/32.png) [@CC](https://boards.straightdope.com/u/CC)\ **Post date:** [October 28, 2014, 10:10pm UTC](https://boards.straightdope.com/t/gmail-connection-is-untrusted/702760/20 "2014-10-28T22:10:28Z")
Not sure what the name was. I wish I’d made a note of it. It was Rocket something, I believe. Don’t know how it got there, but it’s gone now.