Webmail more prone to hacking or virus than dedicated program?

  • Thread starter Thread starter cryptogram
  • Start date Start date
cryptogram said:
Any views?
Click to expand...

Please place your question in the body of the post, as well as using a
suitable subject line. Thanks for your consideration.

Webmail: hacking (because you may have a weak password or fell for some
social engineering)

Dedicated email client: virus (or more accurately, a trojan...)
 
cryptogram said:
Any views?
Click to expand...
Could you rephrase the question?

Are you comparing Webmail to a dedicated program (I assume local client
software) or are you comparing a hack/crack to a virus?
 
Could you rephrase the question?

Are you comparing Webmail to a dedicated program (I assume local client
software) or are you comparing a hack/crack to a virus?
Click to expand...

Both really. Each type of mail has its advantages and disadvantages, but I wondered about the relative security in all ways between the two.
 
Both really. Each type of mail has its advantages and disadvantages, but I wondered about the relative security in all ways between the two.
Click to expand...

There is the time factor. Email clients tend to log on and off
very quickly, webmail usually stays open and auto-refreshing for
hours, sometimes.
Sniffing would be harder with an email client. Less data
exchanged, less packets to examine.
[]'s
 
cryptogram said:
Both really. Each type of mail has its advantages and disadvantages,
but I wondered about the relative security in all ways between the
two.
Click to expand...

If you are considering web-mail vs "client" mail, then I assume you
might have the ability (or are contimplating) running your own mail
server (because if not, then what are your choices for client-mail?
Your ISP? Hotmail / Gmail via pop or imap?)

If you're considering any form of client-mail where the server also
offers web-based mail access, then as far as server-side exploitation
and hacking goes you're no further ahead.

Something else to consider with large-scale e-mail providers
(client-based or web-based, ISP or free-mail) is that they are operating
under laws that might compel them to archive your mail and provide it to
law enforcement when requested. If you operate your own server then the
issue is less clear in that regard.
 
Please place your question in the body of the post, as well as using
a suitable subject line. Thanks for your consideration.

Webmail: hacking (because you may have a weak password or fell for
some social engineering)

Dedicated email client: virus (or more accurately, a trojan...)
Click to expand...

Social engineering is possible there as well. If the client renders html
and the user is click happy. Webmail is vulnerable not only from client
side hacking, but server side as well.
 
Virus Guy said:
Something else to consider with large-scale e-mail providers
(client-based or web-based, ISP or free-mail) is that they are
operating under laws that might compel them to archive your mail and
provide it to law enforcement when requested. If you operate your
own server then the issue is less clear in that regard.
Click to expand...

Sadly, I think the new laws apply to individuals who run their own servers
as well. Nothing really stopping you from misconfiguring it so that it
doesn't archive or keep logs of it's activities. As really, you're running
a server from home. You aren't doing it professionally, so you could slide
once on this excuse.

Your ISP might not want you running local servers tho. That's a grey area
I think tho.
 
From: "Dustin said:
Sadly, I think the new laws apply to individuals who run their own servers
as well. Nothing really stopping you from misconfiguring it so that it
doesn't archive or keep logs of it's activities. As really, you're running
a server from home. You aren't doing it professionally, so you could slide
once on this excuse.

Your ISP might not want you running local servers tho. That's a grey area
I think tho.
Click to expand...

You have to have a "business" level account to run a server otherwise it would violate the
ToS/AUP of a residential account.
 
If you are considering web-mail vs "client" mail, then I assume you
might have the ability (or are contimplating) running your own mail
server (because if not, then what are your choices for client-mail?
Your ISP? Hotmail / Gmail via pop or imap?)

If you're considering any form of client-mail where the server also
offers web-based mail access, then as far as server-side exploitation
and hacking goes you're no further ahead.

Something else to consider with large-scale e-mail providers
(client-based or web-based, ISP or free-mail) is that they are operating
under laws that might compel them to archive your mail and provide it to
law enforcement when requested. If you operate your own server then the
issue is less clear in that regard.
Click to expand...

No, I'm not contemplating this. I just wanted to know if using an email client like Thunderbird is more or less likely to suffer hacking or virus/malware attacks than webmail.
 
cryptogram said:
I just wanted to know if using an email client like Thunderbird
is more or less likely to suffer hacking or virus/malware attacks
than webmail.
Click to expand...

If your machine is comprimized by some sort of back-door trojan or
botnet software, then most probably any username/password you enter for
*anything* will be leveraged by third parties.

If you're using a less-well-known client that performs auto-login (could
be for e-mail, could be some other program like a web-cam viewer) then
if your credentials are already stored (.ini file, registry) then a
trojan might not be looking for those credentials - or know how to find
them or even know how to scan your inbound/outbound data stream for
them. This is a weakness of keyboard input for credentials - a
keylogger is easy to deploy and capture that data.
 
cryptogram said:
Both really. Each type of mail has its advantages and disadvantages, but I wondered about the relative security in all ways between the two.
Click to expand...

Well as for viruses, true viruses can come to your computer in any of
the ways that any other program can (in this case attachments) so I
think it is about the same for both types of e-mail.

Aside from that, it probably depends upon the software being used in
each case and the capabilities of the user. A webmail password being
successfully guessed at gives the intruder the ability to create and
send mail as well as read and get your contact list.

I prefer a local client over having my information residing on a
computer I have no control over.
 
Well as for viruses, true viruses can come to your computer in any of
the ways that any other program can (in this case attachments) so I
think it is about the same for both types of e-mail.

Aside from that, it probably depends upon the software being used in
each case and the capabilities of the user. A webmail password being
successfully guessed at gives the intruder the ability to create and
send mail as well as read and get your contact list.

I prefer a local client over having my information residing on a
computer I have no control over.
Click to expand...


Thanks for your help everyone. I can see that there's no simple answer.
 
Back
Top