Both SSL (IE imaps and smtps) and STARTTLS encrypts the entire
transaction between the client and the server - including the
authentication and the sending of the actual email.
But remember that you need to have it enabled for both sending and
receiving mail - those are separate processes which can (and most often
do) go to different servers.
If the certificate is good, and you do not accept any certificates from
the proxy (they could act as a "man in the middle", but will give you a
warning about a problem with the certificate), there is no way the login
details will be visible for any third parties as long as SSL and/or TLS
is enabled.
The reason some people use GPG/PGP to encrypt the email in addition to
SSL/TLS is that SSL/TLS only encrypts the traffic between the client and
the server, whereas GPG/PGP will encrypt the email all the way from
sender to the receiver, and only the person with the proper private key
will be able to read the email.
SENDER SMTP IMAP RECEIVER
|---- SSL ----|------ PLAINTEXT ------- | ---- SSL ----|
SENDER RECEIVER
|------------------------- GPG ------------------------|
So with GPG you can be sure that only the intended receiver will be
abble to read the mail, and that the mail has not been altered on the way,
With SSL between you and your servers, you can only be certain that
nobody eavesdropped the transaction between you and the server, and that
the email was not altered between you and the server. What happens as
soon as the email is placed on the server is impossible to know.
My guess is that there might be one of several reasons why you started
getting those notifications.
a) It's a scam. The account was not really attacked, but someone sent
you a notification that it might be, and hoped you would click on a
phishing-link to change your password.
b) Google notified you because they saw you connecting from a new place,
or an unsecured proxy.
c) Pure (un)luck. Google accounts are targeted all the time. It might
just be a coincidence that it happened while you were connected to that
proxy.
The internet is a hostile place. I have hundreds, maybe thousands, of
attacks every day, trying to brute force the passwords on my servers.
The only way to protect yourself is to use secure passwords, and don't
take it personally if someone targets you.
On 03/06/2014 05:59 AM, jack wrote:
No it is definitely not my device for sure, except for the first round
of "blocked fraudulent access" messages - the messages with people still
trying to get into my account were text messages using the 2 factor
authentication. None of my accounts on my phone are set to sync
automatically either and neither are they linked with any other app
other than K9. If anything, the account that I had on the Gmail app
itself was left untouched, no one ever tried to get in. I really have a
feeling that K9 is just sending passwords in plain text which is scary.
Someone correct me if I'm wrong but according to articles on how HTTPS
works, SSL/TLS is actually supposed to encrypt the authentication part
from what I understand but the emails themselves are in plain text(which
is why some use PGP for email encryption).
This is one of the reasons why it's supposed to be crucial to log in via
HTTPS to anything that requires a password when connected via an
insecure network like coffee shops, and other public wifi spots. -
Source
http://security.stackexchange.com/questions/1525/is-visiting-https-websites-on-a-public-hotspot-secure
I know there is another vulnerability(man in the middle attack) that
might have been used but it seems SSL/TLS is supposed to protect mostly
against that as well.
Source:
http://security.stackexchange.com/questions/8145/does-https-prevent-man-in-the-middle-attacks-by-proxy-server
Can anyone clarify further or do some tests to see if K9 is actually
sending passwords in plain text?
On Wednesday, March 5, 2014 10:37:45 PM UTC-5, Seth Holmes wrote:
On 3/5/14, 10:14 PM, jack wrote:
> I have SSL/TLS for all my accounts set to always in k9's account
settings..
> but just recently I connected to an insecure proxy(tor). When
connecting to an
> insecure proxy I never do anything that might expose any of my
passwords
> because I do know there are people who might monitor packets on
the other
> side. Except this time I accidentally manually synced my k9
mail(force of
> habit kicked in). 2 minutes later I get notifications from google
saying that
> fraudulent attempts to access my accounts have been blocked.
>
> I was completely confused until I saw I was still connected to
the proxy.. so
> I turned on 2 factor authentication on all of my accounts, and
changed the
> passwords for a few of them(I knew they couldn't get in anyway
for the few I
> didn't change). So I watched my text messages for my accounts
which didn't
> have their passwords changed and someone just kept trying to get
in for the
> next couple of hours/days at random intervals.
>
> My main concern is why the heck is this possible? If SSL is
enabled doesn't
> that mean my passwords are encrypted during transmission? Anyone
intercepting
> packets "should" see nothing but gibberish, right?? But then how
are they able
> to keep trying to get into my account?
>
> Would someone please explain this to me?
It could very well be the GMail app or some other Google related app
on your
device still using the cached password trying to authenticate. It's
worthwhile
to see what IP address the attempts come from and then look to see
if it's
your device.
Overall, IIRC, if you have TTL/SSL turned on, that encrypts the
transactions
between client and server but it's a different option to encrypt the
password.
Your authentication could be in clear text, but sending/receiving
mail is
encrypted.
--
Seth H Holmes
http://www.route-fu.net/
--
--
You received this message because you are subscribed to the K-9 Mail
Users List.
To post to this group, send email to [email protected]
To unsubscribe, email [email protected]
To report an issue with K-9 Mail, visit
http://code.google.com/p/k9mail/issues/list
For more options, visit this group at
http://groups.google.com/group/k-9-mail
---
You received this message because you are subscribed to the Google
Groups "K-9 Mail" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to [email protected]
<mailto:[email protected]>.
For more options, visit https://groups.google.com/groups/opt_out.
--
--
You received this message because you are subscribed to the K-9 Mail Users List.
To post to this group, send email to [email protected]
To unsubscribe, email [email protected]
To report an issue with K-9 Mail, visit
http://code.google.com/p/k9mail/issues/list
For more options, visit this group at http://groups.google.com/group/k-9-mail
---
You received this message because you are subscribed to the Google Groups "K-9 Mail" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
