4 ms·

If they've connected to Gmail before they would have received HSTS headers. So I'm not sure what you are suggesting? Could you elaborate on how you think GSM ci

If they've connected to Gmail before they would have received HSTS headers. So I'm not sure what you are suggesting? Could you elaborate on how you think GSM cipher downgrades lead to stolen Gmail credentials? edit: Furthermore Chrome/Firefox implement HSTS preload lists on which gmail.com is included. [0][1] [0] https://cs.chromium.org/chromium/src/net/http/transport_security_state_static.json https://cs.chromium.org/chromium/src/net/http/transport_secu... [1] https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ https://blog.mozilla.org/security/2012/11/01/preloading-hsts...

MertsA 10y ago
I can see something simple like redirecting random pages to a fake login page. The average person will fall for the simplest of attacks so it wouldn't surprise me to hear that they were just using a captive portal that asked for their Google account credentials to use wifi.
- breatheoften 10y ago
  This doesn't even seem that different from how gmail actually works -- before I stopped using it I was always astonished by the insane chain of redirects the browser is directed through before eventually seeing the login screen.
sowbug 10y ago
The article said people were reporting that Gmail accounts have been hacked in an environment where malicious Wifi APs are prevalent. Your post said that report "sounds suspiciously false." My reply contended that it's possible. A device running something other than a recent version of a modern browser is entirely susceptible to connection to Gmail over a non-TLS pipe or TLS to a MITM, especially when that device is using a fake Wifi AP. Citing that the state of the art in browser technology exists does not change that point. Do you agree it's possible the claim is true?
- forgotpwtomain 10y ago
  > Citing that the state of the art in browser technology exists does not change that point. > Do you agree it's possible the claim is true? HSTS preload lists are not new (the Mozilla blog I referenced above is dated 2012). > The article said people were reporting that Gmail accounts have been hacked in an environment where malicious Wifi APs are prevalent. Your post said that report "sounds suspiciously false." If it's a case of 'technically illiterate user entered gmail credentials on a wifi-login page' than that can happen on literally any wifi-AP. I'm saying that the claim that phones are being forced to connect to fake base-stations mounted on Cessna's (which is possible) is not at all substantiated by reports of people's Gmail accounts being hacked, the later just sounds like lazy journalism as another commenter has pointed out.
  - sowbug 10y ago
    I very much doubt the claims are as narrowly scoped as that. As you say, it's either imprecise journalism or merely repeating the reports of people who are (by definition) terribly confused about what's going on. By the way, I wouldn't call these people technically illiterate. The way you're using that term sets a bar so high that it includes almost everyone. If many people were at that level of technical literacy, we wouldn't have needed HSTS in the first place.
    - tonyarkles 10y ago
      You folks are talking about HSTS and Browsers, but with phones there's a quite simpler attack vector for grabbing email credentials: IMAP. If the FBI has a certificate for imap.gmail.com that is signed by a CA, they can MITM that route. Even for my 2FA GMail setup (where each non-2FA enabled app gets an app-specific password), doing IMAP MITM will get the app-specific password, which would enable further IMAP access.

MertsA 10y ago

I can see something simple like redirecting random pages to a fake login page. The average person will fall for the simplest of attacks so it wouldn't surprise me to hear that they were just using a captive portal that asked for their Google account credentials to use wifi.

breatheoften 10y ago
This doesn't even seem that different from how gmail actually works -- before I stopped using it I was always astonished by the insane chain of redirects the browser is directed through before eventually seeing the login screen.

sowbug 10y ago

The article said people were reporting that Gmail accounts have been hacked in an environment where malicious Wifi APs are prevalent. Your post said that report "sounds suspiciously false." My reply contended that it's possible. A device running something other than a recent version of a modern browser is entirely susceptible to connection to Gmail over a non-TLS pipe or TLS to a MITM, especially when that device is using a fake Wifi AP. Citing that the state of the art in browser technology exists does not change that point. Do you agree it's possible the claim is true?

forgotpwtomain 10y ago
> Citing that the state of the art in browser technology exists does not change that point. > Do you agree it's possible the claim is true? HSTS preload lists are not new (the Mozilla blog I referenced above is dated 2012). > The article said people were reporting that Gmail accounts have been hacked in an environment where malicious Wifi APs are prevalent. Your post said that report "sounds suspiciously false." If it's a case of 'technically illiterate user entered gmail credentials on a wifi-login page' than that can happen on literally any wifi-AP. I'm saying that the claim that phones are being forced to connect to fake base-stations mounted on Cessna's (which is possible) is not at all substantiated by reports of people's Gmail accounts being hacked, the later just sounds like lazy journalism as another commenter has pointed out.
- sowbug 10y ago
  I very much doubt the claims are as narrowly scoped as that. As you say, it's either imprecise journalism or merely repeating the reports of people who are (by definition) terribly confused about what's going on. By the way, I wouldn't call these people technically illiterate. The way you're using that term sets a bar so high that it includes almost everyone. If many people were at that level of technical literacy, we wouldn't have needed HSTS in the first place.
  - tonyarkles 10y ago
    You folks are talking about HSTS and Browsers, but with phones there's a quite simpler attack vector for grabbing email credentials: IMAP. If the FBI has a certificate for imap.gmail.com that is signed by a CA, they can MITM that route. Even for my 2FA GMail setup (where each non-2FA enabled app gets an app-specific password), doing IMAP MITM will get the app-specific password, which would enable further IMAP access.