Mailbox.org discovers unencrypted password transmission in myMail
1–10 of 30 posts
Re: Mailbox.org discovers unencrypted password transmission in myMail
#2I'd never heard of myMail. Turns out it's a mobile only MUA made by a Russian company (https://en.wikipedia.org/wiki/Mail.Ru) and they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago (https://old.reddit.com/r/Android/comments/20u712/beware_myma...)
Re: Mailbox.org discovers unencrypted password transmission in myMail
#3I'd never heard of myMail. Turns out it's a mobile only MUA made by a Russian company ( https://en.wikipedia.org/wiki/Mail.Ru ) and they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago ( https://old.reddit.com/r/Android/comments/20u712/beware_myma... )
>they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago
To be fair microsoft's outlook ios and android clients does the same thing with external providers (like if you used it with fastmail). It is a common practice and something to be aware of when choosing an email app.
EDIT: I'm specifically answering this comment. As for the submission, that was incredibly stupid for them to do in 2023. At this point it should only be opt-in to turn encryption off, not a default.
Re: Mailbox.org discovers unencrypted password transmission in myMail
#4I'd never heard of myMail. Turns out it's a mobile only MUA made by a Russian company ( https://en.wikipedia.org/wiki/Mail.Ru ) and they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago ( https://old.reddit.com/r/Android/comments/20u712/beware_myma... )
>they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago To be fair microsoft's outlook ios and android clients does the same thing with external providers (like if you used it with fastmail). It is a common practice and something to be aware of when choosing an email app. EDIT: I'm specifically answering this comment. As f…
Collecting credentials and reading mail from server is standard practice across hosts of email clients, since it’s the only way to get push notification working. If you don’t trust their server you probably shouldn’t use their client anyway.
Re: Mailbox.org discovers unencrypted password transmission in myMail
#5Earlier quoted context omitted.
>they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago To be fair microsoft's outlook ios and android clients does the same thing with external providers (like if you used it with fastmail). It is a common practice and something to be aware of when choosing an email app. EDIT: I'm specifically answering this comment. As f…
Collecting credentials and reading mail from server is standard practice across hosts of email clients, since it’s the only way to get push notification working. If you don’t trust their server you probably shouldn’t use their client anyway.
BlackBerry was doing this 20 years ago. That's how their push email service (BIS) worked.
And yes I still lament the loss of the blinking red LED, a victim of phone makers today treating devices as if they were a piece of jewelry as opposed to the utilitarian tools they really are.
Re: Mailbox.org discovers unencrypted password transmission in myMail
#6Earlier quoted context omitted.
>they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago To be fair microsoft's outlook ios and android clients does the same thing with external providers (like if you used it with fastmail). It is a common practice and something to be aware of when choosing an email app. EDIT: I'm specifically answering this comment. As f…
Collecting credentials and reading mail from server is standard practice across hosts of email clients, since it’s the only way to get push notification working. If you don’t trust their server you probably shouldn’t use their client anyway.
Apps can't just send notifications? If I had a mail client installed, couldn't the app just periodically connect to my mail server using my internet connection, see new mail was available, and then pop up a notification so I'd know?
That seems much more secure than having a third party collecting my passwords so they can connect to my mail server from their network using my password just to see if any new mail is there, read the messages, then send a notification to my phone to let me know about them.
I'm perfectly happy to trust Thunderbird enough to configure it to check my mailbox, but I wouldn't feel as comfortable handing my login information directly to Mozilla so that they can log into my mailbox whenever they feel like it. I guess Mozilla could push an update that collects my stored login credentials and do that anyway, but if they did I think there would be a lot of folks who'd protest.
Re: Mailbox.org discovers unencrypted password transmission in myMail
#7Earlier quoted context omitted.
Collecting credentials and reading mail from server is standard practice across hosts of email clients, since it’s the only way to get push notification working. If you don’t trust their server you probably shouldn’t use their client anyway.
Apps can't just send notifications? If I had a mail client installed, couldn't the app just periodically connect to my mail server using my internet connection, see new mail was available, and then pop up a notification so I'd know? That seems much more secure than having a third party collecting my passwords so they can connect to my mail server from their network using my password just to see if any new mail is the…
> If I had a mail client installed, couldn't the app just periodically connect to my mail server, see new mail was available, and then pop up a notification so I'd know?
Desktop mail clients do. Phone mail clients can’t, so you either check on a server, or don’t get notifications on time.
Re: Mailbox.org discovers unencrypted password transmission in myMail
#8Earlier quoted context omitted.
Collecting credentials and reading mail from server is standard practice across hosts of email clients, since it’s the only way to get push notification working. If you don’t trust their server you probably shouldn’t use their client anyway.
Apps can't just send notifications? If I had a mail client installed, couldn't the app just periodically connect to my mail server using my internet connection, see new mail was available, and then pop up a notification so I'd know? That seems much more secure than having a third party collecting my passwords so they can connect to my mail server from their network using my password just to see if any new mail is the…
It's debatable whether those are considered push notifications. On one hand, it's pushing the notifications from one program on the device to another. On the other hand, it isn't pushing remotely from a server to the device.
This reminded me of Pointcast Networks. Ah, the 90s. :) https://en.wikipedia.org/wiki/PointCast https://www.youtube.com/watch?v=qCqwB6sruIQ
Re: Mailbox.org discovers unencrypted password transmission in myMail
#9Earlier quoted context omitted.
Apps can't just send notifications? If I had a mail client installed, couldn't the app just periodically connect to my mail server using my internet connection, see new mail was available, and then pop up a notification so I'd know? That seems much more secure than having a third party collecting my passwords so they can connect to my mail server from their network using my password just to see if any new mail is the…
It's debatable whether those are considered push notifications. On one hand, it's pushing the notifications from one program on the device to another. On the other hand, it isn't pushing remotely from a server to the device. This reminded me of Pointcast Networks. Ah, the 90s. :) https://en.wikipedia.org/wiki/PointCast https://www.youtube.com/watch?v=qCqwB6sruIQ
Those are not push notifications, but the push part isn’t the goal, notifications are. The point here is you simply can’t poll on a reliable schedule on mobile devices, so push is the way.
Re: Mailbox.org discovers unencrypted password transmission in myMail
#10Earlier quoted context omitted.
Apps can't just send notifications? If I had a mail client installed, couldn't the app just periodically connect to my mail server using my internet connection, see new mail was available, and then pop up a notification so I'd know? That seems much more secure than having a third party collecting my passwords so they can connect to my mail server from their network using my password just to see if any new mail is the…
> If I had a mail client installed, couldn't the app just periodically connect to my mail server, see new mail was available, and then pop up a notification so I'd know? Desktop mail clients do. Phone mail clients can’t, so you either check on a server, or don’t get notifications on time.
Mobile platforms seem a bit broken. Timer/alarm apps seem to be able to take actions and notify on a regular schedule, it is specifically scheduled network activity that's restricted?