Is Gmail Safe? How do you protect yourself from these kind of attacks?

#1

Post by arunsharma » Sat, Nov 22, 2008, 4:27 AM UTC

Do you trust your gmail ? How do you protect yourself from these kind of attacks ?

Is Gmail Safe? How do you protect yourself from these kind of attacks?
makeuseof.com

Re: Is Gmail Safe? How do you protect yourself from these kind of attacks?

#2

Post by dc2k08 » Sat, Nov 22, 2008, 5:59 AM UTC

His advice is good and probably worth implementing. one thing though..

> Make sure to upgrade your domain to private registration so that your contact details don’t show up on WhoIS searches. If you’re on GoDaddy I’d recommend going with Protected Registration I thought some WHOIS services offered the ability to view cached pages of all previous contact details, no ?

Re: Is Gmail Safe? How do you protect yourself from these kind of attacks?

#3

Post by rksprst » Sat, Nov 22, 2008, 8:04 AM UTC

Can one of the google employees here ask one of their gmail buddies about this?

Re: Is Gmail Safe? How do you protect yourself from these kind of attacks?

#4

Post by syntax-case » Sat, Nov 22, 2008, 8:06 AM UTC

I guess the solution is to use Gmail in a separate browser profile that you won't use for anything else.

http://support.mozilla.com/en-US/kb/Managing+profiles

Re: Is Gmail Safe? How do you protect yourself from these kind of attacks?

#5

Post by technoguyrob » Sat, Nov 22, 2008, 12:23 PM UTC

syntax-case wrote: post #4

I guess the solution is to use Gmail in a separate browser profile that you won't use for anything else. http://support.mozilla.com/en-US/kb/Managing+profiles

And the Gmail engineers should add an opt-out "high security" mode that checks the referer to make sure the form submission is coming from Gmail itself and not some outside website. This way people who like to use custom/blank referers can ignore this security concern if they want, and all the rest of us can prevent the risk of this problem.

EDIT: Or how about just adding an in-line Javascript variable? Say, on all Gmail pages, you could embed this in the page:

   var SECURITY_KEY = "918028cd79a5ba47e83e6ba68d036ca3";

And then when sending AJAX or form requests in the background, make sure to include that as a request parameter. That way, even if the user has the right authentication cookies, external websites won't be able to fool Gmail into thinking they are Gmail.

Really, this doesn't seem like a very hard problem to solve...couple lines of code...

Re: Is Gmail Safe? How do you protect yourself from these kind of attacks?

#6

Post by arunsharma » Sat, Nov 22, 2008, 1:42 PM UTC

http://blogs.zdnet.com/security/?p=554 It looks like the gmail team has created a fix and pushed the fix. It suggests that you keep checking your filters to see if you been rigged as the fix wouldn't fix it (pun intended).

Re: Is Gmail Safe? How do you protect yourself from these kind of attacks?

#7

Post by ramchip » Sat, Nov 22, 2008, 4:15 PM UTC

"...including 2 malware monitors, an antivirus and 2 firewalls" In case the attack is too strong for the first firewall?

Re: Is Gmail Safe? How do you protect yourself from these kind of attacks?

#8

Post by m0nty » Sat, Nov 22, 2008, 6:33 PM UTC

arunsharma wrote: post #6

http://blogs.zdnet.com/security/?p=554 It looks like the gmail team has created a fix and pushed the fix. It suggests that you keep checking your filters to see if you been rigged as the fix wouldn't fix it (pun intended).

That's from a year ago. I think TFA is speculating about the same kind of vulnerability, but active now. It is just speculation, though.

Re: Is Gmail Safe? How do you protect yourself from these kind of attacks?

#9

Post by kwamenum86 » Sat, Nov 22, 2008, 6:34 PM UTC

technoguyrob wrote: post #5

syntax-case wrote: post #4

I guess the solution is to use Gmail in a separate browser profile that you won't use for anything else. http://support.mozilla.com/en-US/kb/Managing+profiles

And the Gmail engineers should add an opt-out "high security" mode that checks the referer to make sure the form submission is coming from Gmail itself and not some outside website. This way people who like to use custom/blank referers can ignore this security concern if they want, and all the rest of us can prevent the risk of this problem. EDIT: Or how about just adding an in-line Javascript variable? Say, on all G…

Is this solution scalable though? Are you saying that they should store this key on the server side for each instance of gmail and then check every single AJAX request to see if the key is present?

Re: Is Gmail Safe? How do you protect yourself from these kind of attacks?

#10

Post by pasbesoin » Sat, Nov 22, 2008, 6:37 PM UTC

syntax-case wrote: post #4

I guess the solution is to use Gmail in a separate browser profile that you won't use for anything else. http://support.mozilla.com/en-US/kb/Managing+profiles

Could this be done by running e.g. a portable instance of Firefox alongside a regular install? I read that a while back some people were doing this to use/test Firefox 2 and 3 concurrently, but I never gave it a try.

Currently, I keep a clean Opera installation solely for high-importance secure transactions, but I like some of the features that (I know, I have to trust them) Firefox extensions add to Gmail. I also don't want to be running Gmail through that clean Opera installation; I want to restrict my use of the latter to access to known sites and trusted content.