Also, IDNs are a common way to implement phishing, so if your browser
supports it, set it to display the punycode version (and always check the
url)... (advice from a semiqualified wannabe hacker ;-)

—Calculator Ftvb

On 28 April 2010 20:45, Sai Emrys <[log in to unmask]> wrote:

> On Wed, Apr 28, 2010 at 7:34 PM, Alex Bicksler <[log in to unmask]>
> wrote:
> > I have my account set to automatically
> > use https, so I thought that'd protect me from this kind of thing.
>
> Kudos for that. But https has almost nothing to do with protecting you
> from this kind of attack.
>
> Most likely, someone either sniffed or guessed your password. IIRC,
> gmail *always* uses https for the password form itself; the option
> only controls whether the rest of your mail is encrypted in transit or
> not.
>
> So the typical avenues are:
> * weak password
> * weak password recovery questions
> * compromised backup email address
> * keyboard logger (i.e. trojan or virus on any machine you have ever
> used to log in, that was active when you did so)
> * shoulder surfing (unlikely given this kind of result; that's more
> for targetted attacks against you personally)
> * "man it the middle" (MITM) attacks that make your computer think
> that the attacker is gmail, thus making it send your password to them
> * phishing (making you log in to an attacker's site that looks
> identical to the real thing, but has a slightly different URL)
> * etc.
>
> The gmail https option only prevents somebody reading your email over
> the wire. Which is good if you don't like random people being able to
> read everything you do.
>
> Good security really is a matter of having to cover *all* possible
> attacks, unfortunately.
>
> - Sai
>
> PS Yes, I'm a hacker (viz. cssfingerprint.com [improved! go visit!]) -
> but I'm generally on the good guys' side. :)
>