Is Gmail Safe? How do you protect yourself from these kind of attacks?

http://www.makeuseof.com/tag/breaking-gmail-security-flaw-more-domains-get-stollen/

by arunsharma • 18 years ago

36 20 18 years ago

Do you trust your gmail ? How do you protect yourself from these kind of attacks ?

dc2k08• 18 years ago

His advice is good and probably worth implementing. one thing though..

> Make sure to upgrade your domain to private registration so that your contact details don’t show up on WhoIS searches. If you’re on GoDaddy I’d recommend going with Protected Registration <

I thought some WHOIS services offered the ability to view cached pages of all previous contact details, no ?

josefresco• 18 years ago

Yeah, I read that the other day ... blanking on the site/url but I remember it being possible. I guess you're screwed either way.

tortilla• 18 years ago

Yeah, for a fee, you can find historical registration info and other goodies:

http://www.domaintools.com/

rksprst• 18 years ago

Can one of the google employees here ask one of their gmail buddies about this?

syntax-case2• 18 years ago

I guess the solution is to use Gmail in a separate browser profile that you won't use for anything else.

http://support.mozilla.com/en-US/kb/Managing+profiles

technoguyrob2• 18 years ago

And the Gmail engineers should add an opt-out "high security" mode that checks the referer to make sure the form submission is coming from Gmail itself and not some outside website. This way people who like to use custom/blank referers can ignore this security concern if they want, and all the rest of us can prevent the risk of this problem.

EDIT: Or how about just adding an in-line Javascript variable? Say, on all Gmail pages, you could embed this in the page:

   <script>var SECURITY_KEY = "918028cd79a5ba47e83e6ba68d036ca3";</script>

And then when sending AJAX or form requests in the background, make sure to include that as a request parameter. That way, even if the user has the right authentication cookies, external websites won't be able to fool Gmail into thinking they are Gmail.

Really, this doesn't seem like a very hard problem to solve...couple lines of code...

kwamenum864• 18 years ago

Is this solution scalable though? Are you saying that they should store this key on the server side for each instance of gmail and then check every single AJAX request to see if the key is present?

syntax-case2• 18 years ago

Server-side is probably the right place to fix it, but I tend to be impatient when it comes to security.

pasbesoin• 18 years ago

Could this be done by running e.g. a portable instance of Firefox alongside a regular install? I read that a while back some people were doing this to use/test Firefox 2 and 3 concurrently, but I never gave it a try.

Currently, I keep a clean Opera installation solely for high-importance secure transactions, but I like some of the features that (I know, I have to trust them) Firefox extensions add to Gmail. I also don't want to be running Gmail through that clean Opera installation; I want to restrict my use of the latter to access to known sites and trusted content.

arunsharma2• 18 years ago

http://blogs.zdnet.com/security/?p=554 It looks like the gmail team has created a fix and pushed the fix. It suggests that you keep checking your filters to see if you been rigged as the fix wouldn't fix it (pun intended).

m0nty• 18 years ago

That's from a year ago. I think TFA is speculating about the same kind of vulnerability, but active now. It is just speculation, though.

kwamenum864• 18 years ago

I would be curious to know how they fixed it in the first place.

ramchip• 18 years ago

"...including 2 malware monitors, an antivirus and 2 firewalls" In case the attack is too strong for the first firewall?

arunsharma2• 18 years ago

:D 2 firewall wouldn't help at all. Use one - the best one .

bedarkened• 18 years ago

Seems like the simple solution would be for Google to require authentication/SSL to create a filter.

Is Gmail Safe? How do you protect yourself from these kind of attacks?

Related Stories