Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If the phone is rooted(as is the case with mine) then an attacker could change the list of trusted Certificate Authorities on the phone and then perform a MITM attack to get any passwords being passed over the air.

However, I think google services use XMPP if I'm not mistaken. In which case the password is never actually transmitted over the air. XMPP uses Digest access authentication[1]. Short version: the server would first send a challenge to the client. The client hashes the challenge with a hash of the password and returns the result. The server performs the same operation and compares. So even with a MITM you'd get nothing. Furthermore, the client itself would never need to store the password either.

[1] http://en.wikipedia.org/wiki/Digest_access_authentication




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: