On 3/5/14, 10:14 PM, jack wrote:
I have SSL/TLS for all my accounts set to always in k9's account settings..
but just recently I connected to an insecure proxy(tor). When connecting to an
insecure proxy I never do anything that might expose any of my passwords
because I do know there are people who might monitor packets on the other
side. Except this time I accidentally manually synced my k9 mail(force of
habit kicked in). 2 minutes later I get notifications from google saying that
fraudulent attempts to access my accounts have been blocked.
I was completely confused until I saw I was still connected to the proxy.. so
I turned on 2 factor authentication on all of my accounts, and changed the
passwords for a few of them(I knew they couldn't get in anyway for the few I
didn't change). So I watched my text messages for my accounts which didn't
have their passwords changed and someone just kept trying to get in for the
next couple of hours/days at random intervals.
My main concern is why the heck is this possible? If SSL is enabled doesn't
that mean my passwords are encrypted during transmission? Anyone intercepting
packets "should" see nothing but gibberish, right?? But then how are they able
to keep trying to get into my account?
Would someone please explain this to me?
It could very well be the GMail app or some other Google related app on your
device still using the cached password trying to authenticate. It's worthwhile
to see what IP address the attempts come from and then look to see if it's
your device.
Overall, IIRC, if you have TTL/SSL turned on, that encrypts the transactions
between client and server but it's a different option to encrypt the password.
Your authentication could be in clear text, but sending/receiving mail is
encrypted.
--
Seth H Holmes
http://www.route-fu.net/
--
--
You received this message because you are subscribed to the K-9 Mail Users List.
To post to this group, send email to [email protected]
To unsubscribe, email [email protected]
To report an issue with K-9 Mail, visit
http://code.google.com/p/k9mail/issues/list
For more options, visit this group at http://groups.google.com/group/k-9-mail
---
You received this message because you are subscribed to the Google Groups "K-9 Mail" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
