up vote 9 down vote favorite
1
share [g+] share [fb]

This is something I've wondered for a long time. If I am, say, using Gmail over https, can someone read my IM conversations and emails if I use an unsecured wireless network? I assume that the data would be secure, since it is using an encrypted connection. Is there anything else to consider?

link|improve this question
67% accept rate
3  
Related must-read article: Firesheep – Sathya♦ Oct 28 '10 at 15:46
1  
I think that it was the article that prompted him/her to ask such a question on this subject. – JFW Oct 28 '10 at 16:11
feedback

6 Answers

up vote 11 down vote accepted

I would think that someone could still perform a man-in-the-middle attack if you're on unsecured wifi (or even secured wifi, if they happen to find a way to be allowed on). This is why you need to always check that the SSL connection shows up green in your address bar and/or manually double-check that the certificate is valid when using unsecured wifi. Assuming that the certificate is correct, then the SSL should protect your data.

link|improve this answer
5  
if truly SSL encrypted with properly checked non compromised SSL certificates then MITM attack is impossible. – ewanm89 Oct 28 '10 at 17:53
@ewanm89 Which is why I iterate that one needs to check the certificate when doing banking/email/anything sensitive over unsecured networks. If you don't notice that the certificate fails to validate, MITM is possible. Luckily webbrowsers these days make it very hard to not notice. – Darth Android Oct 28 '10 at 19:56
To add to @ewanm89, it isn't impossible to be a MITM and sniff packets -- just impossible to read them because they are encrypted. – Brian Reindel Jun 24 '11 at 20:04
Okay, that's splitting hairs. MITM and having a packet that looks just like random data is as pointless as not doing it in the first place in most cases. But yes, one could track what domain a computer is connecting too, but not know the actual data sent/recieved. Also, if we are going to be perfectly honest, I could in theory brute force the AES keys with enough computing power (hint it takes a lot). – ewanm89 Oct 26 '11 at 16:29
Also, I assume the CA isn't compromised, one checks that the CA the site administrators did in fact go to that CA and asked the administrators what the certificate fingerprint should be by another channel. As one can see, properly checking an SSL certificate is rare (though is done in applications like openvpn where the admin distributes the certs before connection, client too to totally verify it). – ewanm89 Oct 26 '11 at 16:35
feedback
up vote 2 down vote

I think your reasoning is correct; to read your information they would need to decrypt the SSL. There would just be one less level of encryption for them to break, in order to access the encrypted data.

link|improve this answer
feedback
up vote 2 down vote

As long as your DNS and your browser's SSL rootkey servers are valid, then an attacker on the same unsecure wireless network as you cannot get into your SSL pipe with a server.

DNS is the big vulnerability in this area - if your DNS chain of servers gets infected by an attacker than can make all manner of things appear to be secure but in fact be insecure.

But if your question is whether a random hacker at an airport or coffee shop is going to be able to hack into your SSL pipe to your bank, the answer is almost certainly not.

link|improve this answer
feedback
up vote 1 down vote

Anyway have in mind that only the data inside the http stream is encrypted but the URLs are not, so maybe someone can impersonate you.

link|improve this answer
This is simply not true. Everything in the requested URL except the domain name is encrypted before being sent through the secured connection. That includes the GET request itself. – Andrew Oct 29 '10 at 18:46
feedback
up vote 1 down vote

No network or encryption is ever going to be 100% secure. You could always encrypt your message yourself before you send it [you may have to write on word or notepad-encpypt then paste or attach to mail] but the person you are sending to would require the password and same system to open it. Depends on who is out there,what equipment they are using and how hard they want to read your mail.

link|improve this answer
feedback
up vote 0 down vote

You also need to consider that the initial non-SSL pages are not protected.

Most secured sites you visit will redirect you from an http to an https url when you go to the login page, but on an untrustworthy network, you might be sent somewhere else by a man in the middle instead.

Consider that you could visit http://firstoverflowbank.com, which would usually redirect you to https://login.firstoverflowbank.com but on the unsecured network is set instead to send you to https://login.flrstoverflowbank.com instead. You likely won't notice, even if you take the time to check and the browser will show everything as being secure.

To avoid this sort of thing, bookmark or type the https:// url directly, never rely on that redirect.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.