Gmail not secure

I keep hearing people talk about sensitive information being sent to google.. which isn't even the problem. The problem is the gmail is going to build a huge profile of every single email message that you send/receive, sensitive or not...

The reason they give you a 1gb storage limit is so that they can build a bigger profile about you. Even worse, if you delete an email message it is just not visible to you, that doesn't mean that the message doesn't exist in it's entirety on the gmail system. I think anybody who uses the "don't send sensitive information" line is underestimating the data mining power of an email system as large as g-mail will undoubtably become.. When you start to think about the possibility of google linking your search profile with your gmail profile they could theoretically tell everyone that you contact, and everything that you search for.. Linking all of that to an IP is one thing, but when you put it to an email address which is personally identifiable it is something else all together.

I for one refuse to be a part of a data mining operation that large that can put together the kind of information that google can and be used for whatever they like without ever letting me know exactly how and what is being used. Just my .02. I won't use gmail other than to test some things out, and I disable all google cookies.

After a bit of research this is what I've found.

The "Tool" used to crack is called Google Hack 0.9b information is HERE and the file is HERE


It is a basic windows app, looks like it was coded in VB or C#. The app requires a L: and P: and you need to sign up for an account at their website LOL.

When 'logged in' there is a field for a username to 'hack' and an option to load a dictionary file (or use the one supplied). It looks like it just does a bunch of HTTP post requests and attempts to log in and then knows when it was sucessful... there is no special 'flaw' in gmail that allows for the app to do this really fast and as soon as gmail employs the 'three password attempts and your account times out for 5min' as it most certainly will this will be useless.

You could hack hotmail in three steps too. Root server, find mailbox, read mail.

...if your gmail account gets 'hacked' its because your password was insecure, not gmail.

Cheers!
Jer

That's something I haven't thought about. There will be 2 week password cookies saved in temp if you enable it, and using that will allow google to put a face on your searches. Very interesting.

If you don't save your password, does gmail still load cookies that can identify a gmail account?

I personally don't like to use free webmail accounts, but that's because I have more private options. And I prefer to be able to send .zip ;)

Quote:

---

Originally posted here by Soda_Popinsky
If you don't save your password, does gmail still load cookies that can identify a gmail account?

---

Sure. They could take that monster cookie they put on your box that doesn't expire until 2038 and compare that to the IP address you use to log into gmail...

Also, they still cookie you even if you don't turn on the "remember me" function.

See attached...

As you can see, if you block the cookies, you can't read your email.

This is VERY interesting...

If Google ever get's subpena'd (sp) to release the search history of one of it's gmail users...

Well...

The marketing stat's are going to be very valuable for them.

edit:

Damn!

Host: google.com/
Modified Date: Mon, 23 Aug 2004 07:53:12 GMT
Expiry Date: Sun, 17 Jan 2038 19:14:07 GMT

The cookies set for the gmail (even though you have it deactivated) are probably nothing more then session cookies which expire once you leave the site or close your browser.

yea and also computers arent yet clever enough to defeat the simplist code, I watched a program on TV last night about 9/11 and the CIA intellegence, and one of the people involved refered to the twin towers as the 2 christmas trees, and how they were going to have to chop down the 2 christmas trees, This defeated echelon, one of most advance, if not the most advanced pieces of kit of this form, a human operator might have looked at this and said hang on, this isnt rite, 2 christmas trees in the afgan desert?

Encrypted messages instantly say your trying to hide something, but normal plain text not using keywords and looking inherently innocent can pass by without to much suspicion and thats what people do.

But PGP is excellent, if you read the book "big breach", (theres an online copy availiable at www.antioffline.com) that shows how secure PGP is..

Ive been using Gmail for a few days and its pretty cool, im planning to rite some code so that I can host my image gallery in there.

i2c

sorry, just read fyrewall's 9/11 conspiracy theory thread....

gmail might be a government client. scanning all these emails and picking up on key words to place adverts (or to notify whoever) ....

the only reason i say this is it strikes me odd that they can provide a free service even during the beta test, with 1 GB capacity for each account. they have an excuse of the adverts and thats where they get their revenue from, but thats like an excuse about a plane thats not really there either, maybe its government funded....

***Apologies for thread, im tired annoyed and a little pissed off, so please excuse this thread, im not thinking straight....***

Quote:

---

the only reason i say this is it strikes me odd that they can provide a free service even during the beta test, with 1 GB capacity for each account. they have an excuse of the adverts and thats where they get their revenue from, but thats like an excuse about a plane thats not really there either, maybe its government funded....

---

So why would Yahoo give me 2GBs of space? Not everything is about the government. There still is a fair amount out there on the wild Internet that is about the bottom line and that is really Google's reason for their 1GB of space. They use it as an opportunity to make money off of what people want. And people are willing to sacrifice their privacy for it.

You could make a conspiracy theory out of just about anything. It just depends on how paranoid you are. There is no point worry about whether Gmail is run by the Govt or whatever.. who really cares?

I personally dont have any emails that the fbi or cia would be interested in :)