Android Gmail App: Stealing Emails via XSS | Hacker News Reader

Android Gmail App: Stealing Emails via XSS

spareclockcycles.org

53 pointsrudenoise11 comments

"I found the bug on 12/3/2010"

Date format used in US is probably the most unintuitive. At first I read that as 12 march 2010. Made me think for a moment that it took Google almost a year to fix it.

The US date format isn't unintuitive if you're fluent in colloquial American english, because that's how we speak dates aloud. You're more likely to hear "March 12, 2010" than "12 March, 2010" in casual conversation.

That said, I try to stick to 12 Mar 2010 (abbreviated textual month) on the intertubes in deference to the fact that the rest of the world formats dates differently, and I find that to be a nice unambiguous middle-ground.

Which came first though, saying March 12 (or 12th?) or writing 3/12? I'd say 12th of March, but I'm in the UK.

I'm a Brit living in the US and had a tense moment at a US airport when I'd "got my date of birth wrong" because I'd used the UK format.

South African here and every time I have to quote my birth date over the phone to validate my identity I usually stutter when trying to get it right.

A person is more likely to say "March 12 2010" instead of something like "12th of March 2010", hence the M/D/Y format.

An American person, perhaps.

I have a soft spot for YYYY-MM-DD, mostly because performing an alphabetic sort on a bunch of files/directories named that way will sort them by date.

Is sending emails through the Android 2.2+ Gmail app "secure" to send over public Wifi?

As far as I know, Gmail always uses SSL for everything. Even the SMTP submission is forced-ssl. So it should be safe to use on unsecured networks, but you can easily verify this with Wireshark or tcpdump.

Mmm you should have a different notion of easy, as it would need a network packet sniffer running in your mobile, testing it with an android emulator in your computer or being able to run software in your AP.

Reply on news.ycombinator.com