No it is definitely not my device for sure, except for the first round of "blocked fraudulent access" messages - the messages with people still trying to get into my account were text messages using the 2 factor authentication. None of my accounts on my phone are set to sync automatically either and neither are they linked with any other app other than K9. If anything, the account that I had on the Gmail app itself was left untouched, no one ever tried to get in. I really have a feeling that K9 is just sending passwords in plain text which is scary. Someone correct me if I'm wrong but according to articles on how HTTPS works, SSL/TLS is actually supposed to encrypt the authentication part from what I understand but the emails themselves are in plain text(which is why some use PGP for email encryption).
This is one of the reasons why it's supposed to be crucial to log in via HTTPS to anything that requires a password when connected via an insecure network like coffee shops, and other public wifi spots. - Source http://security.stackexchange.com/questions/1525/is-visiting-https-websites-on-a-public-hotspot-secure I know there is another vulnerability(man in the middle attack) that might have been used but it seems SSL/TLS is supposed to protect mostly against that as well. Source: http://security.stackexchange.com/questions/8145/does-https-prevent-man-in-the-middle-attacks-by-proxy-server Can anyone clarify further or do some tests to see if K9 is actually sending passwords in plain text? On Wednesday, March 5, 2014 10:37:45 PM UTC-5, Seth Holmes wrote: > > On 3/5/14, 10:14 PM, jack wrote: > > I have SSL/TLS for all my accounts set to always in k9's account > settings.. > > but just recently I connected to an insecure proxy(tor). When connecting > to an > > insecure proxy I never do anything that might expose any of my passwords > > because I do know there are people who might monitor packets on the > other > > side. Except this time I accidentally manually synced my k9 mail(force > of > > habit kicked in). 2 minutes later I get notifications from google saying > that > > fraudulent attempts to access my accounts have been blocked. > > > > I was completely confused until I saw I was still connected to the > proxy.. so > > I turned on 2 factor authentication on all of my accounts, and changed > the > > passwords for a few of them(I knew they couldn't get in anyway for the > few I > > didn't change). So I watched my text messages for my accounts which > didn't > > have their passwords changed and someone just kept trying to get in for > the > > next couple of hours/days at random intervals. > > > > My main concern is why the heck is this possible? If SSL is enabled > doesn't > > that mean my passwords are encrypted during transmission? Anyone > intercepting > > packets "should" see nothing but gibberish, right?? But then how are > they able > > to keep trying to get into my account? > > > > Would someone please explain this to me? > > It could very well be the GMail app or some other Google related app on > your > device still using the cached password trying to authenticate. It's > worthwhile > to see what IP address the attempts come from and then look to see if it's > your device. > > Overall, IIRC, if you have TTL/SSL turned on, that encrypts the > transactions > between client and server but it's a different option to encrypt the > password. > Your authentication could be in clear text, but sending/receiving mail is > encrypted. > > -- > Seth H Holmes > http://www.route-fu.net/ > -- -- You received this message because you are subscribed to the K-9 Mail Users List. To post to this group, send email to [email protected] To unsubscribe, email [email protected] To report an issue with K-9 Mail, visit http://code.google.com/p/k9mail/issues/list For more options, visit this group at http://groups.google.com/group/k-9-mail --- You received this message because you are subscribed to the Google Groups "K-9 Mail" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
