[180140] in North American Network Operators' Group
Re: gmail security is a joke
daemon@ATHENA.MIT.EDU (Valdis.Kletnieks@vt.edu)
Tue May 26 14:15:16 2015
X-Original-To: nanog@nanog.org
To: Saku Ytti <saku@ytti.fi>
In-Reply-To: Your message of "Tue, 26 May 2015 19:11:51 +0300."
<20150526161151.GA14841@pob.ytti.fi>
From: Valdis.Kletnieks@vt.edu
Date: Tue, 26 May 2015 14:15:07 -0400
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
--==_Exmh_1432664107_2099P
Content-Type: text/plain; charset=us-ascii
On Tue, 26 May 2015 19:11:51 +0300, Saku Ytti said:
> > OTOH, recovery by receiving a token at a previously registered alternate email address
> > seems relatively secure to me and I wouldn???t want to opt out of that.
>
> It's probably machine sent in seconds or minute after request, so doing
> short-lived BGP hijack of MX might be reasonably easy way to get the email.
To be fair, if your e-mail address is high enough value that somebody is
willing to risk getting caught doing a BGP hijack, maybe you have bigger
problems to worry about.
--==_Exmh_1432664107_2099P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Exmh version 2.5 07/13/2001
iQIVAwUBVWS4KwdmEQWDXROgAQIvBA/8Dj/Lb5nvbK4NDp0wX9evR8vuC3gpRCx2
f70wA2sra62mQgGuAF3SCXYxe2D86YRtsZ1+rysKvS/7Iv5F4QxFzY7T3h6bsAny
xjjmG0npcTh0WLwypp2Vi36KV4jruJUyMa0QfYU9W6IcX307pkBIKHYfOP91mMKg
SQV6y4AXgSzJGj4+Dok0gaFEEw5rF70+2NY2OCH7+BVlEClBctnzmrEfLTsyZIHf
EoAuduHYzrTUtoVX7PLME9ePfsqzCSGEnkzXWocga9rpJ4XYG4V/fTKiiKcYMrj8
4wUuA7zsrK6AwbhnYqUmuieKhw/k94WXaL1oD2Cyf9k/uL4QNH7m16r0f2P3MbGf
4PKJhguagBsVURZLez+7fj/WpCY0EPG7zkSXQi8yvwR89VzRjRaAlV3EF6ews1ne
qmjOTYqjpdJe+jldUGjaMean/GujiettBz5oRonkHLfJhKxs1RRBO1GgGtRJEASL
llN+OPxS7MKf8+f2RKkt0H6AazmRqfHum+mEQggHUTreRgQSmTaz+QIcV/8Tifmf
+0jYsS8IiSPhzrum2CLzzY+UBQgDIG8KQNI7iboq9n2cN1DEsOMzTb8mhIrPMteP
fDthISrndobVtslQrPahgLzLsars69O+FS1rdDFkcCXpx5UP+BeyDavjEhnfSbte
lSwxKlQVSrU=
=vluA
-----END PGP SIGNATURE-----
--==_Exmh_1432664107_2099P--
