4 ms·
I think that the (theoretical) MITM attack is played out not between the user and google, but google and the other email provider. For example, a person on gmai
by chacham15 13y ago
I think that the (theoretical) MITM attack is played out not between the user and google, but google and the other email provider. For example, a person on gmail sending mail to a yahoo account could be comprimised when google talks to yahoo.
EDIT: Yahoo does NOT use TLS SMTP[1]. Also, Gmail fails Cert verification...[1]
[1]http://www.checktls.com/perl/TestReceiver.pl http://www.checktls.com/perl/TestReceiver.pl
- tptacek 13y agoGoogle uses TLS SMTP. Later Nice catch. I based the Yahoo thing off message board posts with people getting TLS SMTP working, but from their mail clients, not server-to-server. The Google Mail certificates don't validate because their hostname doesn't exactly match the host for which the certificate was issued ("mx.google.com"). I don't think that's a huge problem in practice.
- deleted 13y ago[deleted]