Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is something I've wondered for a long time. If I am, say, using Gmail over https, can someone read my IM conversations and emails if I use an unsecured wireless network? I assume that the data would be secure, since it is using an encrypted connection. Is there anything else to consider?

share|improve this question
Related must-read article: Firesheep – Sathya Oct 28 '10 at 15:46
I think that it was the article that prompted him/her to ask such a question on this subject. – JFW Oct 28 '10 at 16:11
up vote 19 down vote accepted

I would think that someone could still perform a man-in-the-middle attack if you're on unsecured wifi (or even secured wifi, if they happen to find a way to be allowed on). This is why you need to always check that the SSL connection shows up green in your address bar and/or manually double-check that the certificate is valid when using unsecured wifi. Assuming that the certificate is correct, then the SSL should protect your data.

share|improve this answer
if truly SSL encrypted with properly checked non compromised SSL certificates then MITM attack is impossible. – ewanm89 Oct 28 '10 at 17:53
@ewanm89 Which is why I iterate that one needs to check the certificate when doing banking/email/anything sensitive over unsecured networks. If you don't notice that the certificate fails to validate, MITM is possible. Luckily webbrowsers these days make it very hard to not notice. – Darth Android Oct 28 '10 at 19:56
To add to @ewanm89, it isn't impossible to be a MITM and sniff packets -- just impossible to read them because they are encrypted. – Brian Reindel Jun 24 '11 at 20:04
Okay, that's splitting hairs. MITM and having a packet that looks just like random data is as pointless as not doing it in the first place in most cases. But yes, one could track what domain a computer is connecting too, but not know the actual data sent/recieved. Also, if we are going to be perfectly honest, I could in theory brute force the AES keys with enough computing power (hint it takes a lot). – ewanm89 Oct 26 '11 at 16:29
Also, I assume the CA isn't compromised, one checks that the CA the site administrators did in fact go to that CA and asked the administrators what the certificate fingerprint should be by another channel. As one can see, properly checking an SSL certificate is rare (though is done in applications like openvpn where the admin distributes the certs before connection, client too to totally verify it). – ewanm89 Oct 26 '11 at 16:35

I think your reasoning is correct; to read your information they would need to decrypt the SSL. There would just be one less level of encryption for them to break, in order to access the encrypted data.

share|improve this answer

As long as your DNS and your browser's SSL rootkey servers are valid, then an attacker on the same unsecure wireless network as you cannot get into your SSL pipe with a server.

DNS is the big vulnerability in this area - if your DNS chain of servers gets infected by an attacker than can make all manner of things appear to be secure but in fact be insecure.

But if your question is whether a random hacker at an airport or coffee shop is going to be able to hack into your SSL pipe to your bank, the answer is almost certainly not.

share|improve this answer

Anyway have in mind that only the data inside the http stream is encrypted but the URLs are not, so maybe someone can impersonate you.

share|improve this answer
This is simply not true. Everything in the requested URL except the domain name is encrypted before being sent through the secured connection. That includes the GET request itself. – Andrew Oct 29 '10 at 18:46

You also need to consider that the initial non-SSL pages are not protected.

Most secured sites you visit will redirect you from an http to an https url when you go to the login page, but on an untrustworthy network, you might be sent somewhere else by a man in the middle instead.

Consider that you could visit, which would usually redirect you to but on the unsecured network is set instead to send you to instead. You likely won't notice, even if you take the time to check and the browser will show everything as being secure.

To avoid this sort of thing, bookmark or type the https:// url directly, never rely on that redirect.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .