My concern wasn't the first message. It was the subsequent messages with someone "attempting" to enter my account even days after the incident. The subsequent messages that I get from google of someone entering my account is from me turning on 2 factor authentication, it was a 6 digit code that I am supposed to enter after I have entered my password in correctly, but in this case it was not me who was attempting the log in since I would obviously know if I was on my computer trying to attempt such a log in.
But thank you, Ola for confirming that it is encrypted. Can you tell me what you used to see that so I can try to see if it's a bug on my end? On Friday, March 7, 2014 11:06:21 PM UTC-5, John F. Eldredge wrote: > > From my experience, any attempt to log into Gmail via Tor will trigger > such messages. > > > ------------------------------ > *From:* jack <[email protected] <javascript:>> > *Sent:* March 6, 2014 10:19:25 AM CST > *To:* [email protected] <javascript:> > *Subject:* Re: [k-9-mail] Are passwords transmitted in plain text to > email providers?? > > Thank you for all your replies. I double checked my configurations and > like I said all of my accounts are set to SSL/TLS (always) under port 993 > which is IMAPS for incoming(authentication plain), and port 465 for > outgoing(authentication automatic). Has anyone tried to recreate the > problem or checked to see if there is a bug in K9 that is actually sending > it in plain text for some reason? > > As for your points, please see my response below. > > a) It's a scam. The account was not really attacked, but someone sent > you a notification that it might be, and hoped you would click on a > phishing-link to change your password. > > It was a text message with no link, so that could not have been the case. > > b) Google notified you because they saw you connecting from a new place, > or an unsecured proxy.. > > This is most likely the reason for the first set of texts from google > which says they prevented unauthorized access as the IP shows the proxies > IP. > > It does not explain the additional texts(repeatedly) for a log in code > which can only be requested if you know the correct password after I set up > 2FA authentication on my accounts following the incident. I had > specifically NOT changed the password on a few accounts just to see how > many times they'd try to log in, and to specifically make sure that I > wasn't the one requesting the codes and it definitely was not me trying to > log in. > > c) Pure (un)luck. Google accounts are targeted all the time. It might > just be a coincidence that it happened while you were connected to that > proxy. > > I wish it was a coincidence but all of my k9 accounts and only those were > targeted specifically right after I synced from the Proxy. > > I'm still hard pressed that there is a security flaw/bug in K9 itself.. > either on the certificate side allowing MITM attacks or the app is somehow > bypassing my forced TLS configuration and sending things in plain text? > > Also Seth, the reason why I mentioned HTTPS as an example above is because > its very similar to SSL/TLS since it is basically HTTP transported through > SSL/TLS which is the most basic stuff I can understand. The articles > explaining the security of it was used as a starting point since I couldn't > readily find any articles explaining the importance of using SSL/TLS in non > secure open areas prone to packet sniffing. > > > On Thursday, March 6, 2014 2:19:31 AM UTC-5, Ola Thoresen wrote: >> >> Both SSL (IE imaps and smtps) and STARTTLS encrypts the entire >> transaction between the client and the server - including the >> authentication and the sending of the actual email. >> >> But remember that you need to have it enabled for both sending and >> receiving mail - those are separate processes which can (and most often >> do) go to different servers. >> >> If the certificate is good, and you do not accept any certificates from >> the proxy (they could act as a "man in the middle", but will give you a >> warning about a problem with the certificate), there is no way the login >> details will be visible for any third parties as long as SSL and/or TLS >> is enabled. >> >> The reason some people use GPG/PGP to encrypt the email in addition to >> SSL/TLS is that SSL/TLS only encrypts the traffic between the client and >> the server, whereas GPG/PGP will encrypt the email all the way from >> sender to the receiver, and only the person with the proper private key >> will be able to read the email. >> >> >> >> >> SENDER SMTP IMAP RECEIVER >> |---- SSL ----|------ PLAINTEXT ------- | ---- SSL ----| >> >> >> SENDER RECEIVER >> |------------------------- GPG ------------------------| >> >> >> So with GPG you can be sure that only the intended receiver will be >> abble to read the mail, and that the mail has not been altered on the >> way, >> With SSL between you and your servers, you can only be certain that >> nobody eavesdropped the transaction between you and the server, and that >> the email was not altered between you and the server. What happens as >> soon as the email is placed on the server is impossible to know. >> >> >> My guess is that there might be one of several reasons why you started >> getting those notifications. >> >> >> a) It's a scam. The account was not really attacked, but someone sent >> you a notification that it might be, and hoped you would click on a >> phishing-link to change your password. >> >> b) Google notified you because they saw you connecting from a new place, >> or an unsecured proxy. >> >> c) Pure (un)luck. Google accounts are targeted all the time. It might >> just be a coincidence that it happened while you were connected to that >> proxy. >> >> >> The internet is a hostile place. I have hundreds, maybe thousands, of >> attacks every day, trying to brute force the passwords on my servers. >> The only way to protect yourself is to use secure passwords, and don't >> take it personally if someone targets you. >> >> >> >> On 03/06/2014 05:59 AM, jack wrote: >> > No it is definitely not my device for sure, except for the first round >> > of "blocked fraudulent access" messages - the messages with people >> still >> > trying to get into my account were text messages using the 2 factor >> > authentication. None of my accounts on my phone are set to sync >> > automatically either and neither are they linked with any other app >> > other than K9. If anything, the account that I had on the Gmail app >> > itself was left untouched, no one ever tried to get in. I really have a >> > feeling that K9 is just sending passwords in plain text which is scary. >> > Someone correct me if I'm wrong but according to articles on how HTTPS >> > works, SSL/TLS is actually supposed to encrypt the authentication part >> > from what I understand but the emails themselves are in plain >> text(which >> > is why some use PGP for email encryption). >> > >> > This is one of the reasons why it's supposed to be crucial to log in >> via >> > HTTPS to anything that requires a password when connected via an >> > insecure network like coffee shops, and other public wifi spots. - >> > Source >> http://security.stackexchange.com/questions/1525/is-visiting-https-websites-on-a-public-hotspot-secure >> >> > >> > I know there is another vulnerability(man in the middle attack) that >> > might have been used but it seems SSL/TLS is supposed to protect mostly >> > against that as well. >> > Source: >> http://security.stackexchange.com/questions/8145/does-https-prevent-man-in-the-middle-attacks-by-proxy-server >> >> > >> > Can anyone clarify further or do some tests to see if K9 is actually >> > sending passwords in plain text? >> > >> > >> > >> > On Wednesday, March 5, 2014 10:37:45 PM UTC-5, Seth Holmes wrote: >> > >> > On 3/5/14, 10:14 PM, jack wrote: >> > > I have SSL/TLS for all my accounts set to always in k9's account >> > settings.. >> > > but just recently I connected to an insecure proxy(tor). When >> > connecting to an >> > > insecure proxy I never do anything that might expose any of my >> > passwords >> > > because I do know there are people who might monitor packets on >> > the other >> > > side. Except this time I accidentally manually synced my k9 >> > mail(force of >> > > habit kicked in). 2 minutes later I get notifications from >> google >> > saying that >> > > fraudulent attempts to access my accounts have been blocked. >> > > >> > > I was completely confused until I saw I was still connected to >> > the proxy.. so >> > > I turned on 2 factor authentication on all of my accounts, and >> > changed the >> > > passwords for a few of them(I knew they couldn't get in anyway >> > for the few I >> > > didn't change). So I watched my text messages for my accounts >> > which didn't >> > > have their passwords changed and someone just kept trying to get >> > in for the >> > > next couple of hours/days at random intervals. >> > > >> > > My main concern is why the heck is this possible? If SSL is >> > enabled doesn't >> > > that mean my passwords are encrypted during transmission? Anyone >> > intercepting >> > > packets "should" see nothing but gibberish, right?? But then how >> > are they able >> > > to keep trying to get into my account? >> > > >> > > Would someone please explain this to me? >> > >> > It could very well be the GMail app or some other Google related >> app >> > on your >> > device still using the cached password trying to authenticate. It's >> > worthwhile >> > to see what IP address the attempts come from and then look to see >> > if it's >> > your device. >> > >> > Overall, IIRC, if you have TTL/SSL turned on, that encrypts the >> > transactions >> > between client and server but it's a different option to encrypt >> the >> > password. >> > Your authentication could be in clear text, but sending/receiving >> > mail is >> > encrypted. >> > >> > -- >> > Seth H Holmes >> > http://www.route-fu.net/ >> > >> > -- >> > -- >> > You received this message because you are subscribed to the K-9 Mail >> > Users List. >> > To post to this group, send email to [email protected] >> > To unsubscribe, email [email protected] >> > To report an issue with K-9 Mail, visit >> > http://code.google.com/p/k9mail/issues/list >> > For more options, visit this group at >> > http://groups.google.com/group/k-9-mail >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups "K-9 Mail" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an email to [email protected] >> > <mailto:[email protected]>. >> > For more options, visit https://groups.google.com/groups/opt_out. >> >> > -- > John F. Eldredge -- [email protected] <javascript:> > "Darkness cannot drive out darkness; only light can do that. > Hate cannot drive out hate; only love can do that." > Dr. Martin Luther King, Jr. > -- -- You received this message because you are subscribed to the K-9 Mail Users List. To post to this group, send email to [email protected] To unsubscribe, email [email protected] To report an issue with K-9 Mail, visit http://code.google.com/p/k9mail/issues/list For more options, visit this group at http://groups.google.com/group/k-9-mail --- You received this message because you are subscribed to the Google Groups "K-9 Mail" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
