Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird)

2016-04-10 Thread Evgeny Kapun
On 10.04.2016 19:22, Elmar Stellnberger wrote: my gmail password was malversated within a few seconds; i.e. I got a login attempt from HongKong and had to change the password after disconnecting. Is it possible that it was YOUR login attempt? Maybe Google detected your login attempt through V

Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird)

2016-04-10 Thread Elmar Stellnberger
Am 2016-04-11 um 00:00 schrieb Brandon Vincent: TLS properly implemented is secure. The insecure VPN (as you so describe it) may have been stripping out the offer of STARTTLS by the IMAP server. This is pretty trivial to do when you control all of the data flowing through the VPN [1]. This has

Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird)

2016-04-10 Thread Brandon Vincent
On Sun, Apr 10, 2016 at 9:22 AM, Elmar Stellnberger wrote: > Is anyone here who can explain the insecurity of SSL/TLS in its current > state? TLS properly implemented is secure. The insecure VPN (as you so describe it) may have been stripping out the offer of STARTTLS by the IMAP server. This i

SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird)

2016-04-10 Thread Elmar Stellnberger
Dear Readers of Debian-Security, While being connected via an insecure VPN I had once more left my email client open by accident (Thunderbird). Though access to imap.gmail.com shall be secured by SSL/TLS my gmail password was malversated within a few seconds; i.e. I got a login attempt from