>From my experience, any attempt to log into Gmail via Tor will trigger such >messages.
-------- Original Message -------- From: jack <[email protected]> Sent: March 6, 2014 10:19:25 AM CST To: [email protected] Subject: Re: [k-9-mail] Are passwords transmitted in plain text to email providers?? Thank you for all your replies. I double checked my configurations and like I said all of my accounts are set to SSL/TLS (always) under port 993 which is IMAPS for incoming(authentication plain), and port 465 for outgoing(authentication automatic). Has anyone tried to recreate the problem or checked to see if there is a bug in K9 that is actually sending it in plain text for some reason? As for your points, please see my response below. a) It's a scam. The account was not really attacked, but someone sent you a notification that it might be, and hoped you would click on a phishing-link to change your password. It was a text message with no link, so that could not have been the case. b) Google notified you because they saw you connecting from a new place, or an unsecured proxy. This is most likely the reason for the first set of texts from google which says they prevented unauthorized access as the IP shows the proxies IP. It does not explain the additional texts(repeatedly) for a log in code which can only be requested if you know the correct password after I set up 2FA authentication on my accounts following the incident. I had specifically NOT changed the password on a few accounts just to see how many times they'd try to log in, and to specifically make sure that I wasn't the one requesting the codes and it definitely was not me trying to log in. c) Pure (un)luck. Google accounts are targeted all the time. It might just be a coincidence that it happened while you were connected to that proxy. I wish it was a coincidence but all of my k9 accounts and only those were targeted specifically right after I synced from the Proxy. I'm still hard pressed that there is a security flaw/bug in K9 itself.. either on the certificate side allowing MITM attacks or the app is somehow bypassing my forced TLS configuration and sending things in plain text? Also Seth, the reason why I mentioned HTTPS as an example above is because its very similar to SSL/TLS since it is basically HTTP transported through SSL/TLS which is the most basic stuff I can understand. The articles explaining the security of it was used as a starting point since I couldn't readily find any articles explaining the importance of using SSL/TLS in non secure open areas prone to packet sniffing. On Thursday, March 6, 2014 2:19:31 AM UTC-5, Ola Thoresen wrote: > > Both SSL (IE imaps and smtps) and STARTTLS encrypts the entire > transaction between the client and the server - including the > authentication and the sending of the actual email. > > But remember that you need to have it enabled for both sending and > receiving mail - those are separate processes which can (and most often > do) go to different servers. > > If the certificate is good, and you do not accept any certificates from > the proxy (they could act as a "man in the middle", but will give you a > warning about a problem with the certificate), there is no way the login > details will be visible for any third parties as long as SSL and/or TLS > is enabled. > > The reason some people use GPG/PGP to encrypt the email in addition to > SSL/TLS is that SSL/TLS only encrypts the traffic between the client and > the server, whereas GPG/PGP will encrypt the email all the way from > sender to the receiver, and only the person with the proper private key > will be able to read the email. > > > > > SENDER SMTP IMAP RECEIVER > |---- SSL ----|------ PLAINTEXT ------- | ---- SSL ----| > > > SENDER RECEIVER > |------------------------- GPG ------------------------| > > > So with GPG you can be sure that only the intended receiver will be > abble to read the mail, and that the mail has not been altered on the way, > With SSL between you and your servers, you can only be certain that > nobody eavesdropped the transaction between you and the server, and that > the email was not altered between you and the server. What happens as > soon as the email is placed on the server is impossible to know. > > > My guess is that there might be one of several reasons why you started > getting those notifications. > > > a) It's a scam. The account was not really attacked, but someone sent > you a notification that it might be, and hoped you would click on a > phishing-link to change your password. > > b) Google notified you because they saw you connecting from a new place, > or an unsecured proxy. > > c) Pure (un)luck. Google accounts are targeted all the time. It might > just be a coincidence that it happened while you were connected to that > proxy. > > > The internet is a hostile place. I have hundreds, maybe thousands, of > attacks every day, trying to brute force the passwords on my servers. > The only way to protect yourself is to use secure passwords, and don't > take it personally if someone targets you. > > > > On 03/06/2014 05:59 AM, jack wrote: > > No it is definitely not my device for sure, except for the first round > > of "blocked fraudulent access" messages - the messages with people still > > trying to get into my account were text messages using the 2 factor > > authentication. None of my accounts on my phone are set to sync > > automatically either and neither are they linked with any other app > > other than K9. If anything, the account that I had on the Gmail app > > itself was left untouched, no one ever tried to get in. I really have a > > feeling that K9 is just sending passwords in plain text which is scary. > > Someone correct me if I'm wrong but according to articles on how HTTPS > > works, SSL/TLS is actually supposed to encrypt the authentication part > > from what I understand but the emails themselves are in plain text(which > > is why some use PGP for email encryption). > > > > This is one of the reasons why it's supposed to be crucial to log in via > > HTTPS to anything that requires a password when connected via an > > insecure network like coffee shops, and other public wifi spots. - > > Source > http://security.stackexchange.com/questions/1525/is-visiting-https-websites-on-a-public-hotspot-secure > > > > > I know there is another vulnerability(man in the middle attack) that > > might have been used but it seems SSL/TLS is supposed to protect mostly > > against that as well. > > Source: > http://security.stackexchange.com/questions/8145/does-https-prevent-man-in-the-middle-attacks-by-proxy-server > > > > > Can anyone clarify further or do some tests to see if K9 is actually > > sending passwords in plain text? > > > > > > > > On Wednesday, March 5, 2014 10:37:45 PM UTC-5, Seth Holmes wrote: > > > > On 3/5/14, 10:14 PM, jack wrote: > > > I have SSL/TLS for all my accounts set to always in k9's account > > settings.. > > > but just recently I connected to an insecure proxy(tor). When > > connecting to an > > > insecure proxy I never do anything that might expose any of my > > passwords > > > because I do know there are people who might monitor packets on > > the other > > > side. Except this time I accidentally manually synced my k9 > > mail(force of > > > habit kicked in). 2 minutes later I get notifications from google > > saying that > > > fraudulent attempts to access my accounts have been blocked. > > > > > > I was completely confused until I saw I was still connected to > > the proxy.. so > > > I turned on 2 factor authentication on all of my accounts, and > > changed the > > > passwords for a few of them(I knew they couldn't get in anyway > > for the few I > > > didn't change). So I watched my text messages for my accounts > > which didn't > > > have their passwords changed and someone just kept trying to get > > in for the > > > next couple of hours/days at random intervals. > > > > > > My main concern is why the heck is this possible? If SSL is > > enabled doesn't > > > that mean my passwords are encrypted during transmission? Anyone > > intercepting > > > packets "should" see nothing but gibberish, right?? But then how > > are they able > > > to keep trying to get into my account? > > > > > > Would someone please explain this to me? > > > > It could very well be the GMail app or some other Google related app > > on your > > device still using the cached password trying to authenticate. It's > > worthwhile > > to see what IP address the attempts come from and then look to see > > if it's > > your device. > > > > Overall, IIRC, if you have TTL/SSL turned on, that encrypts the > > transactions > > between client and server but it's a different option to encrypt the > > password. > > Your authentication could be in clear text, but sending/receiving > > mail is > > encrypted. > > > > -- > > Seth H Holmes > > http://www.route-fu.net/ > > > > -- > > -- > > You received this message because you are subscribed to the K-9 Mail > > Users List. > > To post to this group, send email to [email protected]<javascript:> > > To unsubscribe, email [email protected] <javascript:> > > To report an issue with K-9 Mail, visit > > http://code.google.com/p/k9mail/issues/list > > For more options, visit this group at > > http://groups.google.com/group/k-9-mail > > > > --- > > You received this message because you are subscribed to the Google > > Groups "K-9 Mail" group. > > To unsubscribe from this group and stop receiving emails from it, send > > an email to [email protected] <javascript:> > > <mailto:[email protected] <javascript:>>. > > For more options, visit https://groups.google.com/groups/opt_out. > > -- -- You received this message because you are subscribed to the K-9 Mail Users List. To post to this group, send email to [email protected] To unsubscribe, email [email protected] To report an issue with K-9 Mail, visit http://code.google.com/p/k9mail/issues/list For more options, visit this group at http://groups.google.com/group/k-9-mail --- You received this message because you are subscribed to the Google Groups "K-9 Mail" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out. -- John F. Eldredge -- [email protected] "Darkness cannot drive out darkness; only light can do that. Hate cannot drive out hate; only love can do that." Dr. Martin Luther King, Jr. -- -- You received this message because you are subscribed to the K-9 Mail Users List. To post to this group, send email to [email protected] To unsubscribe, email [email protected] To report an issue with K-9 Mail, visit http://code.google.com/p/k9mail/issues/list For more options, visit this group at http://groups.google.com/group/k-9-mail --- You received this message because you are subscribed to the Google Groups "K-9 Mail" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
