Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
Webmail more prone to hacking or virus than dedicated program?
64 views
Skip to first unread message
cryptogram
May 19, 2012, 1:52:21 PM5/19/12
to
Any views?
Beauregard T. Shagnasty
May 19, 2012, 2:24:04 PM5/19/12
to
cryptogram wrote:
> Any views?
Please place your question in the body of the post, as well as using a
suitable subject line. Thanks for your consideration.
Webmail: hacking (because you may have a weak password or fell for some
social engineering)
Dedicated email client: virus (or more accurately, a trojan...)
--
-bts
-This space for rent, but the price is high
> Any views?
Please place your question in the body of the post, as well as using a
suitable subject line. Thanks for your consideration.
Webmail: hacking (because you may have a weak password or fell for some
social engineering)
Dedicated email client: virus (or more accurately, a trojan...)
--
-bts
-This space for rent, but the price is high
David H. Lipman
May 19, 2012, 4:42:38 PM5/19/12
to
From: "cryptogram" <rttg...@btinternet.com>
> Any views?
Yes, what BTS stated. Through man in the middle, phishing/Social
Engineering, web site vulnerabilities and other sources of compromising the
account leads webmail more prone to being hacked.
--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp
> Any views?
Yes, what BTS stated. Through man in the middle, phishing/Social
Engineering, web site vulnerabilities and other sources of compromising the
account leads webmail more prone to being hacked.
--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp
Virus Guy
May 19, 2012, 5:26:52 PM5/19/12
to
cryptogram wrote:
> Any views?
Pop3 login attacks also happen. Just how common they are, and how
successful, I don't know.
pop3 login-attack stats:
http://groups.google.com/group/alt.spam/browse_thread/thread/5b4329642e467fed
pop3 login attack stats: Analysis of login-names used (2007 - 2010):
http://groups.google.com/group/alt.spam/browse_thread/thread/370eae8a2f00e5a4
> Any views?
Pop3 login attacks also happen. Just how common they are, and how
successful, I don't know.
pop3 login-attack stats:
http://groups.google.com/group/alt.spam/browse_thread/thread/5b4329642e467fed
pop3 login attack stats: Analysis of login-names used (2007 - 2010):
http://groups.google.com/group/alt.spam/browse_thread/thread/370eae8a2f00e5a4
FromTheRafters
May 19, 2012, 9:33:55 PM5/19/12
to
cryptogram wrote:
> Any views?
Could you rephrase the question?
Are you comparing Webmail to a dedicated program (I assume local client
software) or are you comparing a hack/crack to a virus?
> Any views?
Could you rephrase the question?
Are you comparing Webmail to a dedicated program (I assume local client
software) or are you comparing a hack/crack to a virus?
cryptogram
May 20, 2012, 1:28:10 AM5/20/12
to
Shadow
May 20, 2012, 9:39:50 AM5/20/12
to
very quickly, webmail usually stays open and auto-refreshing for
hours, sometimes.
Sniffing would be harder with an email client. Less data
exchanged, less packets to examine.
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012
Virus Guy
May 20, 2012, 1:32:09 PM5/20/12
to
cryptogram wrote:
> > > Any views?
> > Are you comparing Webmail to a dedicated program (I assume local
> > client software) or are you comparing a hack/crack to a virus?
>
> Both really. Each type of mail has its advantages and disadvantages,
> but I wondered about the relative security in all ways between the
> two.
If you are considering web-mail vs "client" mail, then I assume you
might have the ability (or are contimplating) running your own mail
server (because if not, then what are your choices for client-mail?
Your ISP? Hotmail / Gmail via pop or imap?)
If you're considering any form of client-mail where the server also
offers web-based mail access, then as far as server-side exploitation
and hacking goes you're no further ahead.
Something else to consider with large-scale e-mail providers
(client-based or web-based, ISP or free-mail) is that they are operating
under laws that might compel them to archive your mail and provide it to
law enforcement when requested. If you operate your own server then the
issue is less clear in that regard.
> > > Any views?
> > Are you comparing Webmail to a dedicated program (I assume local
> > client software) or are you comparing a hack/crack to a virus?
>
> Both really. Each type of mail has its advantages and disadvantages,
> but I wondered about the relative security in all ways between the
> two.
might have the ability (or are contimplating) running your own mail
server (because if not, then what are your choices for client-mail?
Your ISP? Hotmail / Gmail via pop or imap?)
If you're considering any form of client-mail where the server also
offers web-based mail access, then as far as server-side exploitation
and hacking goes you're no further ahead.
Something else to consider with large-scale e-mail providers
(client-based or web-based, ISP or free-mail) is that they are operating
under laws that might compel them to archive your mail and provide it to
law enforcement when requested. If you operate your own server then the
issue is less clear in that regard.
Dustin
May 20, 2012, 2:10:03 PM5/20/12
to
"Beauregard T. Shagnasty" <a.non...@example.invalid> wrote in
news:jp8og4$2lv$1...@dont-email.me:
> cryptogram wrote:
>
>> Any views?
>
> Please place your question in the body of the post, as well as using
> a suitable subject line. Thanks for your consideration.
>
> Webmail: hacking (because you may have a weak password or fell for
> some social engineering)
>
> Dedicated email client: virus (or more accurately, a trojan...)
Social engineering is possible there as well. If the client renders html
and the user is click happy. Webmail is vulnerable not only from client
side hacking, but server side as well.
--
Character is doing the right thing when nobody's looking. There are too
many people who think that the only thing that's right is to get by, and
the only thing that's wrong is to get caught. - J.C. Watts
news:jp8og4$2lv$1...@dont-email.me:
> cryptogram wrote:
>
>> Any views?
>
> Please place your question in the body of the post, as well as using
> a suitable subject line. Thanks for your consideration.
>
> Webmail: hacking (because you may have a weak password or fell for
> some social engineering)
>
> Dedicated email client: virus (or more accurately, a trojan...)
and the user is click happy. Webmail is vulnerable not only from client
side hacking, but server side as well.
--
Character is doing the right thing when nobody's looking. There are too
many people who think that the only thing that's right is to get by, and
the only thing that's wrong is to get caught. - J.C. Watts
Dustin
May 20, 2012, 2:12:48 PM5/20/12
to
Virus Guy <Vi...@Guy.com> wrote in news:4FB92A99...@Guy.com:
> Something else to consider with large-scale e-mail providers
> (client-based or web-based, ISP or free-mail) is that they are
> operating under laws that might compel them to archive your mail and
> provide it to law enforcement when requested. If you operate your
> own server then the issue is less clear in that regard.
Sadly, I think the new laws apply to individuals who run their own servers
as well. Nothing really stopping you from misconfiguring it so that it
doesn't archive or keep logs of it's activities. As really, you're running
a server from home. You aren't doing it professionally, so you could slide
once on this excuse.
Your ISP might not want you running local servers tho. That's a grey area
I think tho.
> Something else to consider with large-scale e-mail providers
> (client-based or web-based, ISP or free-mail) is that they are
> operating under laws that might compel them to archive your mail and
> provide it to law enforcement when requested. If you operate your
> own server then the issue is less clear in that regard.
as well. Nothing really stopping you from misconfiguring it so that it
doesn't archive or keep logs of it's activities. As really, you're running
a server from home. You aren't doing it professionally, so you could slide
once on this excuse.
Your ISP might not want you running local servers tho. That's a grey area
I think tho.
David H. Lipman
May 20, 2012, 4:10:59 PM5/20/12
to
From: "Dustin" <bughunte...@gmail.com>
> Virus Guy <Vi...@Guy.com> wrote in news:4FB92A99...@Guy.com:
>
>> Something else to consider with large-scale e-mail providers
>> (client-based or web-based, ISP or free-mail) is that they are
>> operating under laws that might compel them to archive your mail and
>> provide it to law enforcement when requested. If you operate your
>> own server then the issue is less clear in that regard.
>
> Sadly, I think the new laws apply to individuals who run their own servers
> as well. Nothing really stopping you from misconfiguring it so that it
> doesn't archive or keep logs of it's activities. As really, you're running
> a server from home. You aren't doing it professionally, so you could slide
> once on this excuse.
>
> Your ISP might not want you running local servers tho. That's a grey area
> I think tho.
>
>
You have to have a "business" level account to run a server otherwise it would violate the
ToS/AUP of a residential account.
> Virus Guy <Vi...@Guy.com> wrote in news:4FB92A99...@Guy.com:
>
>> Something else to consider with large-scale e-mail providers
>> (client-based or web-based, ISP or free-mail) is that they are
>> operating under laws that might compel them to archive your mail and
>> provide it to law enforcement when requested. If you operate your
>> own server then the issue is less clear in that regard.
>
> Sadly, I think the new laws apply to individuals who run their own servers
> as well. Nothing really stopping you from misconfiguring it so that it
> doesn't archive or keep logs of it's activities. As really, you're running
> a server from home. You aren't doing it professionally, so you could slide
> once on this excuse.
>
> Your ISP might not want you running local servers tho. That's a grey area
> I think tho.
>
>
ToS/AUP of a residential account.
cryptogram
May 20, 2012, 4:12:32 PM5/20/12
to
Virus Guy
May 20, 2012, 5:14:37 PM5/20/12
to
cryptogram wrote:
> I just wanted to know if using an email client like Thunderbird
> is more or less likely to suffer hacking or virus/malware attacks
> than webmail.
If your machine is comprimized by some sort of back-door trojan or
> I just wanted to know if using an email client like Thunderbird
> is more or less likely to suffer hacking or virus/malware attacks
> than webmail.
botnet software, then most probably any username/password you enter for
*anything* will be leveraged by third parties.
If you're using a less-well-known client that performs auto-login (could
be for e-mail, could be some other program like a web-cam viewer) then
if your credentials are already stored (.ini file, registry) then a
trojan might not be looking for those credentials - or know how to find
them or even know how to scan your inbound/outbound data stream for
them. This is a weakness of keyboard input for credentials - a
keylogger is easy to deploy and capture that data.
FromTheRafters
May 20, 2012, 7:17:00 PM5/20/12
to
the ways that any other program can (in this case attachments) so I
think it is about the same for both types of e-mail.
Aside from that, it probably depends upon the software being used in
each case and the capabilities of the user. A webmail password being
successfully guessed at gives the intruder the ability to create and
send mail as well as read and get your contact list.
I prefer a local client over having my information residing on a
computer I have no control over.
cryptogram
May 21, 2012, 1:51:27 PM5/21/12
to
0 new messages