Gmail not secure

I found an article about google's GMail.
If i read the article, it seems that gmail isn't that secure as it should be.
The article says that it can be hacked with 3 simple steps (i doubt it will be simple).

Full article:

Quote:

---

According to a report by OfficialWire, software designed to hack Google's (google.com) newly launched Gmail service was released last week, developed by a hacking group in Australia known as AusPhreak.

The software reportedly allows hackers to break into Gmail accounts by following a simple three-step process. Google, the report said, has already responded with the instigation of a visually-oriented anti-robot test.

The news comes as Google attempts to deal with criticims of the Gmail service from various advocacy groups.

Gmail, Google's free Web-based email service, was launched in April amid controversy when it unveiled plans to generate revenue for the service by using its contextual advertising technologies to scan emails and place ads related to the message contents. Privacy concerns were raised by a number of groups and the California Senate drafted legislation to limits Gmail’s capabilities.

Google's Gmail is currently in beta testing.

---

source: http://www.thewhir.com

When posting a link, if at all possible please include the full link rather than just the one to the main site:

http://thewhir.com/marketwatch/hac080904.cfm

I'm gonig to wait to see how easy it is to be hacked before I start flaming Google. I have yet t ohear what these three simple steps are, adn then I'll be critical of gmail. Personally, I think everybody's jumping on the I-hate-gmail bandwagon for no good reason, maybe they're just sick of hating Microsoft, adn need some one else to hate. As a gmail user, I know that gmail is much better than hotmail or Yahoo. And about the ads...sure, don't send highly confidential emails, but I have no problem with the ads. I don't even notice them most of the time, they're little text ads, not like the huge banners on Hotmail and Yahoo. I don't want to see Google turn into the next Microsoft. The difference is obvious too me: Microsoft selss $hitty products, Google produces great prudcts. For example: the best search engine on earth. So if you need some one to hate, hate me if you must...just don't hate Google.

I can't imagine people sending "highly confidential" or classified matter over gmail, hotmail, yahoo or any other email service on the internet. It is too risky and I am sure companies have policies in place to not allow it. Over local intranet .. now that is fine of course :)

Quote:

---

Originally posted here by fyrewall
I can't imagine people sending "highly confidential" or classified matter over gmail, hotmail, yahoo or any other email service on the internet. It is too risky and I am sure companies have policies in place to not allow it. Over local intranet .. now that is fine of course :)

---

Policies don't stop people unfortunately. It does happen, and it is bad.

Enter PGP:
http://web.mit.edu/network/pgp.html

AFAIK, unbreakable with current computing. Doesn't matter if your email is secure or not if it is encrypted well.

Oh no! You mean someone can be looking at my daily free pr0n?! :eek:

Thats it! I'm going back to yahoo....

Soda: Can you use PGP with web based mail?

Quote:

---

Originally posted here by phishphreek80


Soda: Can you use PGP with web based mail?

---

Hey Hey,

Well I was trying to not post any more as my own personal form of silent protest but I guess I'm too much of an addict.. oh well.... who knows maybe AO will change for the good on it's own...

Anyways the question was directed at Soda.. but the answer is Hushmail. It provides free Web based PGP email.

Peace,
HT

I use gmail, and I like it, I have not had a single problem with it yet. If you have highley confedential stuff dont send it via email, especially a free email service. wow stupid people deserve what they get.

You can use PGP for anything! It has mail client plug ins, but they are not neccessary. You simply copy text into the sys. clipboard, and you select a recipient from your keyring, and the text in your clipboard is encrypted. PGP has servers that you upload your public key to, so you don't have to ask for someones key. Public-private key encryption like this is very powerful. Or you can use conventional encryption, which just takes a private key.
It is a must for anyone with email, especially at the corporate level.


-----BEGIN PGP MESSAGE-----
Version: PGP 8.1 - not licensed for commercial use: www.pgp.com

qANQR1DDDQQJAwKKJ8nBKH9iN2DSUQFtezGmh0+Z/54rkwmOUGX6oLrKHzQYPi5A
wxh+Zcg8UyUII0eavlKa0/Nd7ElMgwo/KpP1llFR9XjS1FHSvIi6BERY85O8A2Uz
cE8X+yW11g==
=bspD
-----END PGP MESSAGE-----

And for our nix and open source fans...
http://www.gnupg.org/

This is completely off topic in regards to email and will only interest paranoids and crypto-freaks, but you can expand your GnuPG setup to encrypt IM's over Gaim. Gaim-e gets GnuPG and Gaim talking and allows you to secure your MSN messages, and it might do other protocols too, I just don't remember at the moment. Be warned if you do play with it, its a hog on system resources if you have a massive key.

http://gaim-e.sourceforge.net/

For those of you thinking that PGP is failsafe, something that may be of concern (possible signature forgery): http://zdnet.com.com/2100-1105_2-5313655.html

I think pgp actually implements RSA for it's public \ private key, which would still be safe?

Yeah, pgp encrypted messages are still "safe", but SHA1 for signatures sound bonked.

Quote:

---

Originally posted here by phunction
I found an article about google's GMail.
If i read the article, it seems that gmail isn't that secure as it should be.
The article says that it can be hacked with 3 simple steps (i doubt it will be simple).

Full article:



source: http://www.thewhir.com

---

Gmail is still beta. Thsi is just one of the bugs that is found and needs to be corrected. I think that Gmail will be secure in the long haul. I myself have a Gmail account and have 3 Invintations left.

-- {Jellybelly}

its a ****ing brute force, choose a decent enough password and you have nothing to worry about
and as for ausphreak they are a recincarnation of a dead group that used to know what they were talking about
if anyone wants the application they are talking about i have it and pfft

How about a proof of concept?

poohsuntzu at gmail.com


Anyone want to give it a shot? If you crack my account toss me a PM. I would rather see how well this "Exploit" holds up in the real world.

Pooh-

Well, I just found out that they changed the way the security question is asked/verified...
(see attached)
Your inbox is going to be inundated.

I don't know whether or not this has anything to do with it but after you put in incorrect things like 3 times I believe it makes you do the security picture thing. This would stop brute force, would it not?

its not a exploit, its just a dictonary attack on the forms and they didnt include a max account try, its been fixed now, it wasnt worth media coverage in the first place
bah
thats all i say

Quote:

---

I can't imagine people sending "highly confidential" or classified matter over gmail, hotmail, yahoo or any other email service on the internet. It is too risky and I am sure companies have policies in place to not allow it. Over local intranet .. now that is fine of course

---

Well you get your confirmation email when u sign up to ebay or paypal or anything else u sign up. A social engineer could also use your email account (Which he/she has access to) and sign up for all sorts of stuff, pay with your paypal account, and if they try to trace it back to them, it traces back to you. I know u can create a new account and dump it when you're done with your ****...but why not put all the blame on another person ;).


As for Gmail...Of course its not as secure as it should be. If it was that secure, it wouldn't be in Beta testing anymore lol. All you have to do is pick a good password, and don't start forwarding all your sensitive email to your Gmail account.

I keep hearing people talk about sensitive information being sent to google.. which isn't even the problem. The problem is the gmail is going to build a huge profile of every single email message that you send/receive, sensitive or not...

The reason they give you a 1gb storage limit is so that they can build a bigger profile about you. Even worse, if you delete an email message it is just not visible to you, that doesn't mean that the message doesn't exist in it's entirety on the gmail system. I think anybody who uses the "don't send sensitive information" line is underestimating the data mining power of an email system as large as g-mail will undoubtably become.. When you start to think about the possibility of google linking your search profile with your gmail profile they could theoretically tell everyone that you contact, and everything that you search for.. Linking all of that to an IP is one thing, but when you put it to an email address which is personally identifiable it is something else all together.

I for one refuse to be a part of a data mining operation that large that can put together the kind of information that google can and be used for whatever they like without ever letting me know exactly how and what is being used. Just my .02. I won't use gmail other than to test some things out, and I disable all google cookies.

After a bit of research this is what I've found.

The "Tool" used to crack is called Google Hack 0.9b information is HERE and the file is HERE


It is a basic windows app, looks like it was coded in VB or C#. The app requires a L: and P: and you need to sign up for an account at their website LOL.

When 'logged in' there is a field for a username to 'hack' and an option to load a dictionary file (or use the one supplied). It looks like it just does a bunch of HTTP post requests and attempts to log in and then knows when it was sucessful... there is no special 'flaw' in gmail that allows for the app to do this really fast and as soon as gmail employs the 'three password attempts and your account times out for 5min' as it most certainly will this will be useless.

You could hack hotmail in three steps too. Root server, find mailbox, read mail.

...if your gmail account gets 'hacked' its because your password was insecure, not gmail.

Cheers!
Jer

That's something I haven't thought about. There will be 2 week password cookies saved in temp if you enable it, and using that will allow google to put a face on your searches. Very interesting.

If you don't save your password, does gmail still load cookies that can identify a gmail account?

I personally don't like to use free webmail accounts, but that's because I have more private options. And I prefer to be able to send .zip ;)

Quote:

---

Originally posted here by Soda_Popinsky
If you don't save your password, does gmail still load cookies that can identify a gmail account?

---

Sure. They could take that monster cookie they put on your box that doesn't expire until 2038 and compare that to the IP address you use to log into gmail...

Also, they still cookie you even if you don't turn on the "remember me" function.

See attached...

As you can see, if you block the cookies, you can't read your email.

This is VERY interesting...

If Google ever get's subpena'd (sp) to release the search history of one of it's gmail users...

Well...

The marketing stat's are going to be very valuable for them.

edit:

Damn!

Host: google.com/
Modified Date: Mon, 23 Aug 2004 07:53:12 GMT
Expiry Date: Sun, 17 Jan 2038 19:14:07 GMT

The cookies set for the gmail (even though you have it deactivated) are probably nothing more then session cookies which expire once you leave the site or close your browser.

yea and also computers arent yet clever enough to defeat the simplist code, I watched a program on TV last night about 9/11 and the CIA intellegence, and one of the people involved refered to the twin towers as the 2 christmas trees, and how they were going to have to chop down the 2 christmas trees, This defeated echelon, one of most advance, if not the most advanced pieces of kit of this form, a human operator might have looked at this and said hang on, this isnt rite, 2 christmas trees in the afgan desert?

Encrypted messages instantly say your trying to hide something, but normal plain text not using keywords and looking inherently innocent can pass by without to much suspicion and thats what people do.

But PGP is excellent, if you read the book "big breach", (theres an online copy availiable at www.antioffline.com) that shows how secure PGP is..

Ive been using Gmail for a few days and its pretty cool, im planning to rite some code so that I can host my image gallery in there.

i2c

sorry, just read fyrewall's 9/11 conspiracy theory thread....

gmail might be a government client. scanning all these emails and picking up on key words to place adverts (or to notify whoever) ....

the only reason i say this is it strikes me odd that they can provide a free service even during the beta test, with 1 GB capacity for each account. they have an excuse of the adverts and thats where they get their revenue from, but thats like an excuse about a plane thats not really there either, maybe its government funded....

***Apologies for thread, im tired annoyed and a little pissed off, so please excuse this thread, im not thinking straight....***

Quote:

---

the only reason i say this is it strikes me odd that they can provide a free service even during the beta test, with 1 GB capacity for each account. they have an excuse of the adverts and thats where they get their revenue from, but thats like an excuse about a plane thats not really there either, maybe its government funded....

---

So why would Yahoo give me 2GBs of space? Not everything is about the government. There still is a fair amount out there on the wild Internet that is about the bottom line and that is really Google's reason for their 1GB of space. They use it as an opportunity to make money off of what people want. And people are willing to sacrifice their privacy for it.

You could make a conspiracy theory out of just about anything. It just depends on how paranoid you are. There is no point worry about whether Gmail is run by the Govt or whatever.. who really cares?

I personally dont have any emails that the fbi or cia would be interested in :)