2

I've been trying out a few desktop email clients (Windows) to better manage my e-mail.

As I tried Thunderbird, Inky, and Outlook, it occurred to me, what guarantee is there that my e-mail/pass won't be compromised by using email clients?

Wouldn't it be really simple for the author(s) of e-mail clients to incorporate a function that sends the users' login info to a predefined server?

I just wanted to know whether I'm being paranoid or is this a valid concern?

1

The concerns you raised in all honesty can be said about any piece of software that you install. Browsers for example could use a similar method to capture login details for any site you visit. In fact in this instance many people already trust their browser with those details (firefox and Safari already store form fills as well as stores login credentials as do many other pieces of software).

The biggest potential for vulnerability with email clients is more in the configuration than the trust of the mail client. If for example you do not configure the mail client to use SSL or TLS then the traffic is sent in plain text.

Potential Issues With The Client

The first potential issue with the client is as you suggest. It would be a trivial task for a mail client developer to implement such a method as to send your credentials to an outside source thus capturing those details for nefarious means. If the client is a well known piece of software then this is unlikely. If such a feature was found it would destroy the reputation of the software and the developer.

Another potential would be for a plugin or malware to have similar intentions. Again if it was a legitimate plugin their reputation would be destroyed. Malware developers on the other hand would not really care.

Another potential issue could be if your mail client did not properly use encryption methods or used a non encrypted connection as a fallback. If this happened then the traffic between your client and the server would be sent in plaintext and would be trivial for someone in the right place to be able to retrieve your login details (hence why you should never use unencrypted connections on open WiFi connections).

Lastly another issue that could occur would be if for example someone managed to carry out a man in the middle attack. If they were able to modify your client machines DNS they could essentially redirect traffic to their server and capture the details this way.

1

It's a valid concern. Any software which runs on your desktop can execute any code it wants. You need to trust your software to be authentic. You can transfer some risk mitigation to your firewall, antivirus, host based intrusion detection, or other anti-malware to some degree. But, if you have already installed the application and enabled firewall rules, etc. they likely won't be much help to prevent such exfiltration.

Most desktop clients are not encrypting your account passwords, and there are plenty of tools which can recover passwords from instant messaging clients, email clients, and browser. You would need to find a product at least claiming encryption that uses a master password to protect your other passwords. Also note though, you will have to trade off convenience and security in most cases - the decrypted credentials need to at least be stored in memory to be used continually; if they are discarded after downloading/sending your email, you would have to put in the master password again each time, since most mail client connections are not persistent.

  • Here is a tool which can recover the passwords stored locally by an email client: nirsoft.net/utils/mailpv.html – Eric G May 20 '14 at 18:37
  • I've tested out mailpv - it successfully worked against Outlook Express. – SilverlightFox May 21 '14 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.