Mailbox.org discovers unencrypted password transmission in myMail

Post by Avamander » Sun, May 07, 2023, 11:26 AM UTC

hannob wrote: post #14

Interestingly, this is another security issue with STARTTLS. The whole concept of first establishing an unencrypted connection and only then upgrading to encryption is fragile in multiple ways. Admittedly, this is a pet peeve of mine, as I've co-authored a paper about it. I wonder why mailbox.org does not recommend that users switch from STARTTLS to implicit TLS for SMTP/POP3/IMAP, as this would mitigate such issues…

Post by rwalle » Sun, May 07, 2023, 12:13 PM UTC

db48x wrote: post #18

kolmogorov wrote: post #13

Earlier quoted context omitted.

the OS won't let you do that reliably unless the user also keeps opening the app. background processing is heavily limited for the right reasons.

iOS does that, maybe, but Android doesn’t. The mail client I use on my Android phone notifies me in a timely fashion when new mail arrives, often in less than a second. It just uses IMAP’s IDLE command to wait for new mail. If the connection drops it can just open a new one.

Post by justsomehnguy » Sun, May 07, 2023, 10:17 PM UTC

hardwaresofton wrote: post #25

hannob wrote: post #14

Interestingly, this is another security issue with STARTTLS. The whole concept of first establishing an unencrypted connection and only then upgrading to encryption is fragile in multiple ways. Admittedly, this is a pet peeve of mine, as I've co-authored a paper about it. I wonder why mailbox.org does not recommend that users switch from STARTTLS to implicit TLS for SMTP/POP3/IMAP, as this would mitigate such issues…

Thank you for writing this, I use it as a reference when explaining the difference STARTTLS and implicit TLS and why people should choose one over the other. Another nice one is that implicit TLS is SNI routable (and thus much easier to route) -- this is the main reason for me, and I wish the standard had been updated to encourage more people to try 465 (or have a way to specify port in DNS records for example). Huge…

Post by retox » Sun, May 07, 2023, 10:45 PM UTC

joecool1029 wrote: post #3

autoexec wrote: post #2

I'd never heard of myMail. Turns out it's a mobile only MUA made by a Russian company ( https://en.wikipedia.org/wiki/Mail.Ru ) and they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago ( https://old.reddit.com/r/Android/comments/20u712/beware_myma... )

>they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago To be fair microsoft's outlook ios and android clients does the same thing with external providers (like if you used it with fastmail). It is a common practice and something to be aware of when choosing an email app. EDIT: I'm specifically answering this comment. As f…

Post by hulitu » Mon, May 08, 2023, 7:56 AM UTC

oefrha wrote: post #4

joecool1029 wrote: post #3

Earlier quoted context omitted.

>they were seen collecting people's usernames and passwords and using those logins to read people's messages from their own servers almost a decade ago To be fair microsoft's outlook ios and android clients does the same thing with external providers (like if you used it with fastmail). It is a common practice and something to be aware of when choosing an email app. EDIT: I'm specifically answering this comment. As f…

Collecting credentials and reading mail from server is standard practice across hosts of email clients, since it’s the only way to get push notification working. If you don’t trust their server you probably shouldn’t use their client anyway.