3 ms·
> Citing that the state of the art in browser technology exists does not change that point. > Do you agree it's possible the claim is true? HSTS preload lists
by forgotpwtomain 10y ago
> Citing that the state of the art in browser technology exists does not change that point.
> Do you agree it's possible the claim is true?
HSTS preload lists are not new (the Mozilla blog I referenced above is dated 2012).
> The article said people were reporting that Gmail accounts have been hacked in an environment where malicious Wifi APs are prevalent. Your post said that report "sounds suspiciously false."
If it's a case of 'technically illiterate user entered gmail credentials on a wifi-login page' than that can happen on literally any wifi-AP. I'm saying that the claim that phones are being forced to connect to fake base-stations mounted on Cessna's (which is possible) is not at all substantiated by reports of people's Gmail accounts being hacked, the later just sounds like lazy journalism as another commenter has pointed out.
- sowbug 10y agoI very much doubt the claims are as narrowly scoped as that. As you say, it's either imprecise journalism or merely repeating the reports of people who are (by definition) terribly confused about what's going on. By the way, I wouldn't call these people technically illiterate. The way you're using that term sets a bar so high that it includes almost everyone. If many people were at that level of technical literacy, we wouldn't have needed HSTS in the first place.
- tonyarkles 10y agoYou folks are talking about HSTS and Browsers, but with phones there's a quite simpler attack vector for grabbing email credentials: IMAP. If the FBI has a certificate for imap.gmail.com that is signed by a CA, they can MITM that route. Even for my 2FA GMail setup (where each non-2FA enabled app gets an app-specific password), doing IMAP MITM will get the app-specific password, which would enable further IMAP access.