2

How risky is it to check my email on my smartphone on an open Wi-Fi network (i.e. Starbucks or Old Navy)? Is this only risky if someone is snooping? Do they have to be there, or can they leave a recording device and come back later to collect the data?

Specifically, what if I am checking my Yahoo mail? Can someone see and steal my password and then log into my email account?

Also, what if I am using webmail to check my personal domain email via SquirrelMail. I don't think it is an HTTPS connection. Does this matter, and will HTTPS help?

As you might guess, I'm bit clueless on this and want to know what the odds of anything happening are and how it would happen.

Update: based on the answer below, I'm updating this question:

When I access and log onto Yahoo mail, I see HTTPS in the browser so I'm assuming it is a safe connection and I'm safe to enter my password and log in. Please answer below if this is not correct.

What I have learned from the first answer was that logging into my domain webmail via a regular HTTP link is risky. I checked and I can log into my webmail the following way (I've modified the URLs below to remove personal info)...

  1. I enter https://www.mydomainname.com/webmail

  2. This leads me to: https://serverZ.myhost.com:2096/unprotected/redirect.html?goto_uri=

  3. I enter my user name and password in the popup window and hit enter

  4. Now I am logged in at: https://serverZ.myhost.com:2096/cpsess#######/webmail/x3/?login=1 and I can read my emails.

Does the above way of logging into webmail via the HTTPS route seem safe on an open Wi-Fi network? Can I relax now, or should I worry?

Improve this question
5
  • 1
    You are using an email service that transmits email using TLS encryption whether its imap, smtp, pop or https, correct? If not, then, yes.
    – Fiasco Labs
    Jul 23, 2015 at 19:42
  • 1
    Hi, what cipher suite for HTTPS are you using? If the cipher is weak, the HTTPS is also weak.
    – Vilican
    Jul 24, 2015 at 15:34
  • What is a cipher suite? Is that part of the website or my smartphone? I'm focusing on my webmail right now. I am using squirrelmail, and am accessing as listed above via https. Please let me know what you mean by cipher suite (remember I am non-technical on this). Thanks! PS. The links above were changed to make them no specific to my site, so they don't work.
    – if_it_aint_broke
    Jul 24, 2015 at 16:14
  • Cipher suite is configuration on your web server. It specifies which SSL/TLS algorithms are allowed. If you allow weak ciphers in your suite, your SSL/TLS connection CAN be weak. Also, the SSL protocols are insecure. By the way, you can test it here: ssllabs.com/ssltest
    – Vilican
    Jul 24, 2015 at 17:37
  • Thanks for the link to ssllabs. I tested mydomainname.com because I have my own ssl cert installed and got an over grade of B. I'm not sure how to interpret all the results. But because I think I am accessing my webmail via my webhost's ssl certificate, I also tested serverx.mywebhost.com which ended up testing just mywebhost.com to see if they were different, and they got the same overall B grade. What do I look for in the results?
    – if_it_aint_broke
    Jul 25, 2015 at 14:17

2 Answers 2

Reset to default
7

non-technical answer:

If your connection is (good) encrypted between your Phone and your Mailserver - it should not be a problem. But if not - or accessing via web interface without HTTPS -some bad people or companies will be able to read the data.

If you do not trust the encryption and also not the network - don't do it.

You also have to trust your Phone/Laptop for handling Certificates in a right way, otherwise someone could offer your another Cert and SSL/TLS connection and decrypt it and encrypt it and pass them to your Server (Man in the Middle)

Conclusion:

If you can ensure a safe encrypted connection point to point (Phone - Mailserver) with a good cypher - everything should be ok - if you can not ensure this - stay away.

Improve this answer
6
  • thanks! to follow up though... when I access my yahoo email, I see a padlock. I take it this means it is encrypted and per your response safe. But when I access my squirrelmail webmail, there is no password. Should I work on getting it switched to https? And is this only an issue if someone is actively snooping? can they then get my password? thanks!
    – if_it_aint_broke
    Jul 23, 2015 at 19:08
  • @if_it_aint_broke - if the padlock and the cert is always the same (in your trusted network and in the free wifi) then it is "safe" but if there is no padlock the connection is not encrypted and it is possible to capture and read in plaintext your password. So if it's possible - switch to SSL (also a self-signed Cert is really cool and good)
    – bMalum
    Jul 23, 2015 at 19:14
  • ok, so it sounds like yahoo which shows https is ok, but my webmail which shows http is risky. I'll see if I can get squirrelmail changed to ssl which I have on my website. To follow up though, is it only risky IF someone is snooping, and what are the odds of this?
    – if_it_aint_broke
    Jul 23, 2015 at 19:27
  • @if_it_aint_broke: Sniffing is easily done in unprotected networks like public hotspots and can easily be automated. Have a look at firesheep.
    – Steffen Ullrich
    Jul 23, 2015 at 19:51
  • @if_it_aint_broke Although it's worth noting that e-mail, generally, isn't all that secure. You can't assume mail servers are sending anything to each other over encrypted channels, and you can't assume that the "From:" line is accurate. The current state of e-mail is, in many ways, extremely broken from a security perspective.
    – Parthian Shot
    Jul 24, 2015 at 6:53
0

The likelihood of someone sitting in or near a restaurant and capturing network traffic is quite small. I'm not saying it hasn't been done, but for most consumers, it will prove to be not a big deal.

However, in the cases of checking email, this can be more sensitive. Webmail though HTTPS is secure enough to deter most (if not all) attacks. As long as your complete session of email reading is done with HTTPS, all is well. Some websites can leak content by placing content delivered over HTTP on the same page. Mozilla Firefox will warn users about this behaviour with an icon in the address bar.

Demonstration of Firefox's warning for insecure/secure content mixture.

The bigger concern should be that you are connecting to a reputable network. It is possible for the routing device to "inspect" SSL connections. A secure lock icon will be seen, and even the name and issuing authority may prove to be correct. As GRC points out, the figerprint will be different (https://www.grc.com/fingerprints.htm).

Only websites with authentic Extended Validation (EV) certificates viewed with Firefox or Chrome are immune to tampering (as far as we are aware).

This is much more likely in a corporate environment, but Microsoft's Forefront Threat Management Gateway shows evidence of HTTPS "inspection" capabilities:

Microsoft knows this could land people in some heat.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .