I use a good MUA: Thunderbird [to read/reply to my emails on Gmail].

So: what happens, if i go to a place, where is public wifi, and someone tryes to sniff my password/username/emails?

- Is gmail available only via IMAP/SMTP with SSL? [sslstrip-like attack could get my passwords?]
- if someone spoofs "smtp.gmail.com", then Thunderbird will notice, and complain about that the SSL cert is bad?

If someone could clear this in my head i would be happy:P

1 Answer 1


Thunderbird will complain if it gets a "wrong certificate". A "wrong certificate" is a certificate that either contains the wrong name (i.e. it does not designate the expected server name), or cannot be validated by Thunderbird (not signed, directly or indirectly, by a root CA that Thunderbird trusts; not valid at the current date; or any of the other hundred tests which lurk deep in X.509 validation process).

Thunderbird, by default, trusts about 80 root CA. Claiming that none of them may be bribed or conned into emitting a fake certificate is a kind of leap of faith. You can, though, trim that list at will (Preferences -> Advanced -> Certificates -> View Certificates).

Also, when Thunderbird complains, it does so in a non-fatal way: the user can still override, and it is as simple as clicking on a "do it now you moron" button. Refusing the certificate means not reading your emails; the email-reading urge is such that many users will readily bypass the security warning without remorse, often without even reading the warning message.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .