Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I use a good MUA: Thunderbird [to read/reply to my emails on Gmail].

So: what happens, if i go to a place, where is public wifi, and someone tryes to sniff my password/username/emails?

Questions:
- Is gmail available only via IMAP/SMTP with SSL? [sslstrip-like attack could get my passwords?]
- if someone spoofs "smtp.gmail.com", then Thunderbird will notice, and complain about that the SSL cert is bad?

If someone could clear this in my head i would be happy:P

share|improve this question

1 Answer 1

up vote 7 down vote accepted

Thunderbird will complain if it gets a "wrong certificate". A "wrong certificate" is a certificate that either contains the wrong name (i.e. it does not designate the expected server name), or cannot be validated by Thunderbird (not signed, directly or indirectly, by a root CA that Thunderbird trusts; not valid at the current date; or any of the other hundred tests which lurk deep in X.509 validation process).

Thunderbird, by default, trusts about 80 root CA. Claiming that none of them may be bribed or conned into emitting a fake certificate is a kind of leap of faith. You can, though, trim that list at will (Preferences -> Advanced -> Certificates -> View Certificates).

Also, when Thunderbird complains, it does so in a non-fatal way: the user can still override, and it is as simple as clicking on a "do it now you moron" button. Refusing the certificate means not reading your emails; the email-reading urge is such that many users will readily bypass the security warning without remorse, often without even reading the warning message.

share|improve this answer
1  
mail.google.com is on the list of full valid certificates that have been issued to attackers: comodo.com/Comodo-Fraud-Incident-2011-03-23.html –  Hendrik Brummermann Mar 23 '11 at 22:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.