On 3/5/14, 11:59 PM, jack wrote:
No it is definitely not my device for sure, except for the first round of
"blocked fraudulent access" messages - the messages with people still trying
to get into my account were text messages using the 2 factor authentication.
None of my accounts on my phone are set to sync automatically either and
neither are they linked with any other app other than K9. If anything, the
account that I had on the Gmail app itself was left untouched, no one ever
tried to get in. I really have a feeling that K9 is just sending passwords in
plain text which is scary. Someone correct me if I'm wrong but according to
articles on how HTTPS works, SSL/TLS is actually supposed to encrypt the
authentication part from what I understand but the emails themselves are in
plain text(which is why some use PGP for email encryption).
This is one of the reasons why it's supposed to be crucial to log in via HTTPS
to anything that requires a password when connected via an insecure network
like coffee shops, and other public wifi spots. -
Source
http://security.stackexchange.com/questions/1525/is-visiting-https-websites-on-a-public-hotspot-secure
I know there is another vulnerability(man in the middle attack) that might
have been used but it seems SSL/TLS is supposed to protect mostly against that
as well.
Source:
http://security.stackexchange.com/questions/8145/does-https-prevent-man-in-the-middle-attacks-by-proxy-server
Can anyone clarify further or do some tests to see if K9 is actually sending
passwords in plain text?
You are terribly misunderstanding things. HTTPS is recommended for web
traffic, it's true. But HTTPS is not used for e-mail traffic. You are using
SMTP and (IMAP or POP3). There are SSL/TLS encrypted versions of SMTP and IMAP
(and possibly POP3, I don't honestly know). However, the authentication
portion, unless configured to do so, is not encrypted this way. it's a
separate option. Look at your Account Settings -> Fetching Mail -> Incoming
server settings. There is an option for authentication which can be Plain or
CRAM_MD5.
Under Accout Settings -> Sending Mail -> Outgoing server settings there is a
similar option.
The point of using a proxy is to encrypt traffic on an unknown network. But if
the proxy itself is unsecured and unknown, it's far worse than just going
direct because it's logging your traffic and you're letting some unknown
person or persons read your traffic. If everything is encrypted, you don't
need the proxy.
--
Seth H Holmes
http://www.route-fu.net/
--
--
You received this message because you are subscribed to the K-9 Mail Users List.
To post to this group, send email to [email protected]
To unsubscribe, email [email protected]
To report an issue with K-9 Mail, visit
http://code.google.com/p/k9mail/issues/list
For more options, visit this group at http://groups.google.com/group/k-9-mail
---
You received this message because you are subscribed to the Google Groups "K-9 Mail" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
