Intercepted plaintext login details on the web

Hello
We've recently had our server compromised by some unscrupulous types who gained access via FTP. I think this is because our FTP details were in some way harvested in between source and destination as we were using plain old FTP and not SFTP as we are now.

This got me think about all username and passwords passing over the web.
I notice when I log into my Gmail account that the SSL lock appears in the browser. But, when I log into Orange mail there is no such lock icon and therefore I am assuming that the login details are passed to Orange in plaintext and could therefore be intercepted. Is this the case?

The same gos for Outlook and Thunderbird, they don't appear to have any encryption so are they also send out login credentials to the web in plain text?

If anyone can shed any light on this for me I'd appreciate it.
Thanks
B

 

If you are using plain mail protocols in Thunderbird/Outlook (like POP3) you will always send your password in clear over the internet. In order to solve this problem, you can encrypt your mail protocol session by using TLS/SSL. For this to work, you need an emal client that supports TLS/SSL (Thunderbird for instance) and that is properly configured to use it, but you also need a mail server that supports this kind of encryption.
You can find out more about TLS here: http://en.wikipedia.org/wiki/Transport_Layer_Security

 

Thanks for your answer, I will look into that.

One of the web application servers I am working on does not support secure FTP so I am doing my stuff over FTP then going in to the control panel and changing the FTP password to something new so it can't be abused.
However I've just noticed that the control panel is not SSL protected therefore I'm sending my new password (and the control panel password) in plain text every time I do this!

I know it's unlikely that people will get these passwords out on the web but it's happened once so I naturally think it could happen again.
Is it common for people to get these passwords and how do they do it?

Thanks
B

 

I thought this might be relevent.

http://isc.sans.org/diary.html?storyid=7567