Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mailbox.org discovers unencrypted password transmission in myMail

mailbox.org

Post reply on HN
Print view View original

11–20 of 30 posts

Re: Mailbox.org discovers unencrypted password transmission in myMail

#11

Post by joecool1029 »

autoexec wrote: post #6
oefrha wrote: post #4

Earlier quoted context omitted.

Collecting credentials and reading mail from server is standard practice across hosts of email clients, since it’s the only way to get push notification working. If you don’t trust their server you probably shouldn’t use their client anyway.

Apps can't just send notifications? If I had a mail client installed, couldn't the app just periodically connect to my mail server using my internet connection, see new mail was available, and then pop up a notification so I'd know? That seems much more secure than having a third party collecting my passwords so they can connect to my mail server from their network using my password just to see if any new mail is the…

>Apps can't just send notifications?

They can but consider this: How would they know to send them?

If you are adding a provider only locally there's no way for the app to know to generate a notification if it doesn't have an IMAP idle connection open constantly or scheduled polling. If the app is shipped by the email provider (like gmail app for ios using a gmail account) they can send pushes without leaving connection open or polling.

The point of having your details with the app developer is that their servers will remain always connected to your email provierr and generate pushes that will go over Apple or Google's push network.

Re: Mailbox.org discovers unencrypted password transmission in myMail

#12

Post by autoexec »

joecool1029 wrote: post #11
autoexec wrote: post #6

Earlier quoted context omitted.

Apps can't just send notifications? If I had a mail client installed, couldn't the app just periodically connect to my mail server using my internet connection, see new mail was available, and then pop up a notification so I'd know? That seems much more secure than having a third party collecting my passwords so they can connect to my mail server from their network using my password just to see if any new mail is the…

>Apps can't just send notifications? They can but consider this: How would they know to send them? If you are adding a provider only locally there's no way for the app to know to generate a notification if it doesn't have an IMAP idle connection open constantly or scheduled polling. If the app is shipped by the email provider (like gmail app for ios using a gmail account) they can send pushes without leaving connecti…

I can see it making sense if you're already using the mail servers of the company that made the app (gmail for example) since they already have unrestricted access to your login info and mailbox anyway.

I guess otherwise I'd rather it be my phone regularly polling my mail server over my connection than a third party regularly polling it using theirs. I can see it being a popular option for folks on expensive/very limited data plans though. It doesn't take a ton of bandwidth to poll a mail server, but checking every 5-10 minutes it could add up.

Re: Mailbox.org discovers unencrypted password transmission in myMail

#13

Post by kolmogorov »

autoexec wrote: post #12
joecool1029 wrote: post #11

Earlier quoted context omitted.

>Apps can't just send notifications? They can but consider this: How would they know to send them? If you are adding a provider only locally there's no way for the app to know to generate a notification if it doesn't have an IMAP idle connection open constantly or scheduled polling. If the app is shipped by the email provider (like gmail app for ios using a gmail account) they can send pushes without leaving connecti…

I can see it making sense if you're already using the mail servers of the company that made the app (gmail for example) since they already have unrestricted access to your login info and mailbox anyway. I guess otherwise I'd rather it be my phone regularly polling my mail server over my connection than a third party regularly polling it using theirs. I can see it being a popular option for folks on expensive/very lim…

the OS won't let you do that reliably unless the user also keeps opening the app. background processing is heavily limited for the right reasons.

Re: Mailbox.org discovers unencrypted password transmission in myMail

#14

Post by hannob »

Interestingly, this is another security issue with STARTTLS. The whole concept of first establishing an unencrypted connection and only then upgrading to encryption is fragile in multiple ways.

Admittedly, this is a pet peeve of mine, as I've co-authored a paper about it. I wonder why mailbox.org does not recommend that users switch from STARTTLS to implicit TLS for SMTP/POP3/IMAP, as this would mitigate such issues more generally. This is also in line with current RFCs (RFC 8314).

https://nostarttls.secvuln.info/

Re: Mailbox.org discovers unencrypted password transmission in myMail

#15

Post by Dalton9 »

oefrha wrote: post #9
benatkin wrote: post #8

Earlier quoted context omitted.

It's debatable whether those are considered push notifications. On one hand, it's pushing the notifications from one program on the device to another. On the other hand, it isn't pushing remotely from a server to the device. This reminded me of Pointcast Networks. Ah, the 90s. :) https://en.wikipedia.org/wiki/PointCast https://www.youtube.com/watch?v=qCqwB6sruIQ

Those are not push notifications, but the push part isn’t the goal, notifications are. The point here is you simply can’t poll on a reliable schedule on mobile devices, so push is the way.

Mail polling doesn't require accuracy. The OS won't delay your polling timer more than 10 minutes in the most aggressive cases, which is perfectly fine.

I'm sure the third party you share your email just to get push notifications with isn't monitoring your mailbox to the second either...

Re: Mailbox.org discovers unencrypted password transmission in myMail

#16

Post by Dalton9 »

autoexec wrote: post #10
oefrha wrote: post #7

Earlier quoted context omitted.

> If I had a mail client installed, couldn't the app just periodically connect to my mail server, see new mail was available, and then pop up a notification so I'd know? Desktop mail clients do. Phone mail clients can’t, so you either check on a server, or don’t get notifications on time.

Mobile platforms seem a bit broken. Timer/alarm apps seem to be able to take actions and notify on a regular schedule, it is specifically scheduled network activity that's restricted?

yes mobile OSes will delay and group background activity especially if it involves network access. But we're talking minutes, not hours of delay... Some phones are very aggressive and the app will need to show a persistent notification to keep background polling working, though.

I've never used a mobile client that used a third party to monitor a mailbox, they all do polling as you suggest. I'm not sure the man in the middle approach it's as common as OP is implying here (for non-first party clients).

Re: Mailbox.org discovers unencrypted password transmission in myMail

#17

Post by db48x »

Dalton9 wrote: post #15
oefrha wrote: post #9

Earlier quoted context omitted.

Those are not push notifications, but the push part isn’t the goal, notifications are. The point here is you simply can’t poll on a reliable schedule on mobile devices, so push is the way.

Mail polling doesn't require accuracy. The OS won't delay your polling timer more than 10 minutes in the most aggressive cases, which is perfectly fine. I'm sure the third party you share your email just to get push notifications with isn't monitoring your mailbox to the second either...

They probably are. If they connect via IMAP, they can use the IDLE and/or the NOTIFICATION command to get notifications of new messages arriving. This is generally as prompt as it gets; the server doesn’t wait much before sending the notifications.

Re: Mailbox.org discovers unencrypted password transmission in myMail

#18

Post by db48x »

kolmogorov wrote: post #13
autoexec wrote: post #12

Earlier quoted context omitted.

I can see it making sense if you're already using the mail servers of the company that made the app (gmail for example) since they already have unrestricted access to your login info and mailbox anyway. I guess otherwise I'd rather it be my phone regularly polling my mail server over my connection than a third party regularly polling it using theirs. I can see it being a popular option for folks on expensive/very lim…

the OS won't let you do that reliably unless the user also keeps opening the app. background processing is heavily limited for the right reasons.

iOS does that, maybe, but Android doesn’t. The mail client I use on my Android phone notifies me in a timely fashion when new mail arrives, often in less than a second. It just uses IMAP’s IDLE command to wait for new mail. If the connection drops it can just open a new one.

Re: Mailbox.org discovers unencrypted password transmission in myMail

#19

Post by janosdebugs »

autoexec wrote: post #6
oefrha wrote: post #4

Earlier quoted context omitted.

Collecting credentials and reading mail from server is standard practice across hosts of email clients, since it’s the only way to get push notification working. If you don’t trust their server you probably shouldn’t use their client anyway.

Apps can't just send notifications? If I had a mail client installed, couldn't the app just periodically connect to my mail server using my internet connection, see new mail was available, and then pop up a notification so I'd know? That seems much more secure than having a third party collecting my passwords so they can connect to my mail server from their network using my password just to see if any new mail is the…

Given the shoddy "battery saving" behavior of various Android vendors, probably not. I have a phone collecting dust that was so bad in this regard that no matter of tuning and disabling battery optimizations would get notifications to work in all apps.

Re: Mailbox.org discovers unencrypted password transmission in myMail

#20

Post by leni536 »

oefrha wrote: post #4
joecool1029 wrote: post #3

Earlier quoted context omitted.

>they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago To be fair microsoft's outlook ios and android clients does the same thing with external providers (like if you used it with fastmail). It is a common practice and something to be aware of when choosing an email app. EDIT: I'm specifically answering this comment. As f…

Collecting credentials and reading mail from server is standard practice across hosts of email clients, since it’s the only way to get push notification working. If you don’t trust their server you probably shouldn’t use their client anyway.

Why would this be the only way? I have IMAP push reliably working with k9mail on Android.
Post reply on HN