using web proxies - safe to enter passwords?

Question

Wanted to check something on a local site and see how the outside world sees it. however, using a web proxy im not sure that when i enter my credentials the proxy wont record this and give the proxy owner access to my site.

is there another way to see my own site as though I was on the other side?

Answer 1

The proxy could indeed be set to record any credentials that go through it. I'd reccomend changing the password, using the proxy, and changing it right back.

Answer 2

It can be done safely, but only if you're using only a TLS-encrypted HTTP to access the site (encrypting not just the credentials themselves, but the entire page they're on) and only if you're using a valid CA-signed certificate. Just before entering your credentials through the web proxy, make sure the certificate your browser is using matches the one you paid for. If there are any discrepancies at all, get the heck out of there.

TLS (formerly called SSL) is encrypted on the client and decrypted on the server using asymmetric public key cryptography. Assuming the web proxy returns a valid certificate signed by a CA (and assuming you haven't given the proxy your certificate's private key), the connection cannot be forged or changed in any way.

Even still, web proxies can be a little shady, so I'd recommend following Phoshi's advice anyways, changing your password afterwards just in case you make a mistake and leak some information.

Answer 3

If you don't want to use some proxy server, and can't use some remote desktop on some friend's computer, then all you can do is not go through the internet.

Without any detail about your setup, I assume you're using some domain name?

A browser will ask your computer which IP address goes with the domain name you enter. Your computer will solve that question using DNS. This will then give the browser the public IP address of your internet connection, which often is the IP address of your modem/router. For inbound connections, your modem then forwards it to whatever computer you've told it to. But when using that same domain name from within your own network, a modem/router will often show some configuration web page instead.

To stay within your own network (which is not truly the same as how others access your site) and avoid seeing such configuration page:

• Use the local IP address, which might be something like http://192.168.1.1 or http://10.0.0.1 (On Windows, use IPCONFIG to display the local IP address, on a Mac use ifconfig.)

• If the web server is on your own computer, use http://localhost or http://127.0.0.1

• Fool your computer into mapping the domain name to some local IP address, using the hosts file, no matter what any official DNS server says. Like for example:

  192.168.1.1 example.com www.example.com

  or add the names to an existing entry for 127.0.0.1, like:

  127.0.0.1 localhost loopback example.com www.example.com