5 ms·

Makes me curious if Gmail tells you when new/suspicious IMAP connections are made. I know they do tell you for normal web logins. Off to disable IMAP where I

by tyingq 5y ago

Makes me curious if Gmail tells you when new/suspicious IMAP connections are made. I know they do tell you for normal web logins. Off to disable IMAP where I don't need it...

compsciphd 5y ago
most people dont even need an imap password if using a client like thunderbird. It will juset pop up a webpage to generate an oauth token that it will use.
jdavis703 5y ago
Enable two-factor authentication and disable app passwords. That should be enough to stop this particular type of scam.
lupire 5y ago
Gmail only allows connections OAuth clients, by default. https://support.google.com/a/answer/9003945?hl=en https://support.google.com/a/answer/9003945?hl=en
pseudo0 5y ago
I'm not sure about Gmail, but Outlook does, and it's kind of interesting to check out https://account.microsoft.com/security https://account.microsoft.com/security > Sign-in activity and see all the random IPv6 addresses unsuccessfully trying to connect via IMAP. My email was in some random db dump (with a password I didn't reuse) probably a decade ago and apparently people are still trying to cred stuff it.
dhosek 5y ago
I've gotten notifications from gmail when there were logins from outside the US to my account.
- tyingq 5y ago
  Right...for regular Gmail logins though, or IMAP ones?
  - reaperducer 5y ago
    Google does recognize new IMAP logins. Every time I buy a new device and port my account, I get spam from Google saying, "You're new iPad isn't set up yet without the Gmail app! Get the Gmail app now or you won't be super duper cool!"
  - SilverRed 5y ago
    You can't just log in via username/password with IMAP anymore. The email client either has to support the google login window or you have to go in to your account and generate a program specific access token for it.
gscott 5y ago
You have to go through a number of extra steps to turn on being able to get your mail outside of gmail. I think most never bother. I believe it is called allow insecure devices.
- SilverRed 5y ago
  IIRC, you can log in with external clients, but those clients need to support the embedded google login screen which can ask for 2FA / anything else. If you want to log in with just an email and password then you have to change that setting.
stef25 5y ago
The article mentions that lots of German and French ISPs are being hit, I guess they're going after @orange.fr address and the like? Gmail is pretty secure, I seriously doubt you can log in to someone's account using just their password if you don't have their usual IP, Geo location, User Agent etc. EDIT looks like maybe I'm wrong: “It’s just more difficult to get through the Web interface because on a website you have a plethora of advanced authentication controls at your fingertips, including things like device fingerprinting, scanning for http header anomalies, and so on,” Bill said. “But what are the detection signatures you have available for detecting malicious logins via IMAP?”
- tialaramex 5y ago
  if the user has 2FA then GMail needs either 1. RFC 7628 OAUTHBEARER. Basically your IMAP client has to have a way to obtain OAUTH tokens (e.g. spawn a web browser window first time you log in, that authenticates because it's a web browser, then get it to give you an OAUTH token) and it binds that token to your IMAP login as proof of who you are. Google also supports a non-standard older way to do this. Cheesy "my first IMAP implementation" code can't do this, but several Free Software mail clients do. 2. User goes into Google's security settings, says they agree to suffer worse security, gets "app password" minted by Google, fills that into the IMAP client. They can't use their "real" password which is presumably "password1" so the Pwned list doesn't work on this but it's not great. But if you never set up any 2FA then it really wouldn't matter. Google's answer for their own employees was just to issue them FIDO Security Keys and mandate 2FA, and that's certainly what I'd endorse if you have money and want security, but their medium term plan is to enforce 2FA setup for users who seem to own e.g. a smartphone.

by tyingq 5y ago

Makes me curious if Gmail tells you when new/suspicious IMAP connections are made. I know they do tell you for normal web logins. Off to disable IMAP where I don't need it...

compsciphd 5y ago

most people dont even need an imap password if using a client like thunderbird. It will juset pop up a webpage to generate an oauth token that it will use.

jdavis703 5y ago

Enable two-factor authentication and disable app passwords. That should be enough to stop this particular type of scam.

lupire 5y ago

Gmail only allows connections OAuth clients, by default. https://support.google.com/a/answer/9003945?hl=en https://support.google.com/a/answer/9003945?hl=en

pseudo0 5y ago

I'm not sure about Gmail, but Outlook does, and it's kind of interesting to check out https://account.microsoft.com/security https://account.microsoft.com/security > Sign-in activity and see all the random IPv6 addresses unsuccessfully trying to connect via IMAP. My email was in some random db dump (with a password I didn't reuse) probably a decade ago and apparently people are still trying to cred stuff it.

dhosek 5y ago

I've gotten notifications from gmail when there were logins from outside the US to my account.

tyingq 5y ago
Right...for regular Gmail logins though, or IMAP ones?
- reaperducer 5y ago
  Google does recognize new IMAP logins. Every time I buy a new device and port my account, I get spam from Google saying, "You're new iPad isn't set up yet without the Gmail app! Get the Gmail app now or you won't be super duper cool!"
- SilverRed 5y ago
  You can't just log in via username/password with IMAP anymore. The email client either has to support the google login window or you have to go in to your account and generate a program specific access token for it.

gscott 5y ago

You have to go through a number of extra steps to turn on being able to get your mail outside of gmail. I think most never bother. I believe it is called allow insecure devices.

SilverRed 5y ago
IIRC, you can log in with external clients, but those clients need to support the embedded google login screen which can ask for 2FA / anything else. If you want to log in with just an email and password then you have to change that setting.

stef25 5y ago

The article mentions that lots of German and French ISPs are being hit, I guess they're going after @orange.fr address and the like? Gmail is pretty secure, I seriously doubt you can log in to someone's account using just their password if you don't have their usual IP, Geo location, User Agent etc. EDIT looks like maybe I'm wrong: “It’s just more difficult to get through the Web interface because on a website you have a plethora of advanced authentication controls at your fingertips, including things like device fingerprinting, scanning for http header anomalies, and so on,” Bill said. “But what are the detection signatures you have available for detecting malicious logins via IMAP?”

tialaramex 5y ago
if the user has 2FA then GMail needs either 1. RFC 7628 OAUTHBEARER. Basically your IMAP client has to have a way to obtain OAUTH tokens (e.g. spawn a web browser window first time you log in, that authenticates because it's a web browser, then get it to give you an OAUTH token) and it binds that token to your IMAP login as proof of who you are. Google also supports a non-standard older way to do this. Cheesy "my first IMAP implementation" code can't do this, but several Free Software mail clients do. 2. User goes into Google's security settings, says they agree to suffer worse security, gets "app password" minted by Google, fills that into the IMAP client. They can't use their "real" password which is presumably "password1" so the Pwned list doesn't work on this but it's not great. But if you never set up any 2FA then it really wouldn't matter. Google's answer for their own employees was just to issue them FIDO Security Keys and mandate 2FA, and that's certainly what I'd endorse if you have money and want security, but their medium term plan is to enforce 2FA setup for users who seem to own e.g. a smartphone.