4 ms·
You folks are talking about HSTS and Browsers, but with phones there's a quite simpler attack vector for grabbing email credentials: IMAP. If the FBI has a cert
by tonyarkles 10y ago
You folks are talking about HSTS and Browsers, but with phones there's a quite simpler attack vector for grabbing email credentials: IMAP. If the FBI has a certificate for imap.gmail.com that is signed by a CA, they can MITM that route.
Even for my 2FA GMail setup (where each non-2FA enabled app gets an app-specific password), doing IMAP MITM will get the app-specific password, which would enable further IMAP access.