3 ms·

If I use Thunderbird to send an email to foo@example.com, via Gmail, submitted with TLS encrypted SMTP on port 587, and Google decrypts my transmission and forw

If I use Thunderbird to send an email to foo@example.com, via Gmail, submitted with TLS encrypted SMTP on port 587, and Google decrypts my transmission and forwards it to mail.example.com unencrypted, is Google performing a MITM attack on my communication with example.com? No, they are providing the service I requested. The Nokia browser is essentially a thin client that communicates with a remotely hosted web browser. The remote web browser, running on Nokia's servers, does all the complicated JavaScript and advanced CSS stuff, and converts it to a dumbed down version that can be displayed on the phone. There clearly is a cost savings in using low-end parts. Not all screens are created equal, for example the Nokia Asha 306 uses a 240x400px resistive touchscreen. If you have ever used a phone with a resistive touchscreen you know how bad they are. It also has 32MB of RAM, 10MB of user storage, 2G data (not 3G), and no GPS. You can't run a WebKit + V8 browser on a phone with those specs, you just can't. The BOM for a Nokia Lumia 900 (high end, with a 480x800px capacitive touchscreen) is here: http://www.isuppli.com/Teardowns/News/Pages/Nokia-900-Carries-Bill-of-Materials-of-$209.aspx http://www.isuppli.com/Teardowns/News/Pages/Nokia-900-Carrie...

bad_user 14y ago
In your example the certificate you're being given when connecting through SMTP is for smtp.gmail.com. It is this certificate that proves your connection is to smtp.gmail.com and not somebody else. That's the whole freaking point of HTTPS. What Google does from there, it's their business, but NO, they are not the man in the middle, as you explicitly and willfully connected to them and allowed them to send email on your behalf. On the other hand, connecting to HTTPS with one of these Nokia phones leaves you with the impression that HTTPS connections to google.com are secure, when in fact the Nokia device is LYING TO YOU. The example you've given couldn't have been any worst.
- antoncohen 14y ago
  Nokia is not faking certs. The "browser" only talks to .browser.ovi.com and the SSL certs are issued to .browser.ovi.com. SSL is working exactly as they should. The "security researcher" didn't understand the results he was seeing and freaked out. The Nokia phone only does a DNS lookup of .browser.ovi.com, it only connects to .browser.ovi.com, and it only gets an SSL cert from .browser.ovi.com. Here is post from the "security researcher", so you can see who the certs are issued to: http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/ http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/
  - deleted 14y ago
    [deleted]
  - benatkin 14y ago
    Except GMail and Twitter's intent in offering SSL is not to offer it to .browser.ovi.com but to offer it to users' devices.

bad_user 14y ago

In your example the certificate you're being given when connecting through SMTP is for smtp.gmail.com. It is this certificate that proves your connection is to smtp.gmail.com and not somebody else. That's the whole freaking point of HTTPS. What Google does from there, it's their business, but NO, they are not the man in the middle, as you explicitly and willfully connected to them and allowed them to send email on your behalf. On the other hand, connecting to HTTPS with one of these Nokia phones leaves you with the impression that HTTPS connections to google.com are secure, when in fact the Nokia device is LYING TO YOU. The example you've given couldn't have been any worst.

antoncohen 14y ago
Nokia is not faking certs. The "browser" only talks to .browser.ovi.com and the SSL certs are issued to .browser.ovi.com. SSL is working exactly as they should. The "security researcher" didn't understand the results he was seeing and freaked out. The Nokia phone only does a DNS lookup of .browser.ovi.com, it only connects to .browser.ovi.com, and it only gets an SSL cert from .browser.ovi.com. Here is post from the "security researcher", so you can see who the certs are issued to: http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/ http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/
- deleted 14y ago
  [deleted]
- benatkin 14y ago
  Except GMail and Twitter's intent in offering SSL is not to offer it to .browser.ovi.com but to offer it to users' devices.