Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible for my ISP to see the passwords that I enter on websites and in chat programs? And what about SSL websites that start with https, do they encrypt my username and password before reaching the ISP?

share|improve this question

migrated from serverfault.com Jan 11 '11 at 22:54

This question came from our site for professional system and network administrators.

3  
Is it possible? Yes for non SSL stuff (which isn't foolproof, but I'm trying to keep this short and practical). Is it likely? Not so much. –  RobM Jan 11 '11 at 22:35
    
Related: Can my ISP monitor me? –  Arjan Jan 13 '11 at 13:19
add comment

5 Answers 5

up vote 15 down vote accepted

If you start at an https:// address, everything is encrypted between your computer and the remote server, so your ISP can't intercept any of your data. Your ISP could easily view any non-ssl (http://) connections though.

Note that the firesheep firefox plugin exposed a hole in this mechanism last year. Many websites use https just for your initial login and then switch back to http for the rest of the traffic. In this case your ISP could intercept your traffic after you logged in. Someone else on your local network could also run the firesheep plugin and hijack your session with say facebook and impersonate you.

Most large websites are now transitioning to https all the time to fix this hole. It's not really something you need to worry about on your home network too much, but you should be aware of how this works.

Assuming you're not ignoring certificate warnings, and your computer/browser has not been compromised.

share|improve this answer
    
@Arjan - with that edit this answer is much better. Cheers. –  Rory Alsop Jan 13 '11 at 13:52
    
Also, should note that other protocols (i.e.: telnet) are cleartext-only. YMMV with chat protocols. –  Iszi Jan 13 '11 at 15:43
    
Yes the warning about chat programs is a good one, as they may use different protocols. –  Phil Hollenback Jan 13 '11 at 21:53
    
@Iszi Nobody uses telnet, I assume? I only ever used such things for fun (sic). –  Camilo Martin May 27 '13 at 1:38
    
@CamiloMartin You'd be surprised. The first examples that come to mind are MUDs. I'm sure there's others. –  Iszi May 28 '13 at 15:21
show 1 more comment

I think you might wanna watch the following video from 27th Chaos Communication Congress (CCC):

"How the Internet sees you: demonstrating what activities most ISPs see you doing on the Internet"

  1. Info Page
  2. Video (embed) and mp4 to download
  3. Pdf of the speak
share|improve this answer
add comment

Philiph is right for "If you start at an https:// address, everything is encrypted between your computer and the remote server" with one caveat: all you know with HTTPS is that everything is encrypted between your computer and somewhere else.

There is a risk that your communications could be tampered with at the ISP using a man in the middle attack — and if you think that that can't happen, see the news about Tunisia which shows what can happen if a malicious agent has access at ISP level.

This can only be avoided if:

  • A user always uses the correct https:// URL.
  • A user does not ignore certificate warnings.
  • The user is 100% sure their computer has not been tampered with.

Otherwise, an ISP could tamper with the connection in a way a non-tech savvy user may not notice.

share|improve this answer
    
Wrong: breaking-up HTTPS connections is widely used in big companies because there are various appliances for it (Astaro HTTPS Scanning, Blue Coat, etc). –  weeheavy Jan 13 '11 at 13:36
    
@Arjan - end users often have difficulty understanding cert warnings, so that assumption is unfortunately flawed, which is why the Tunisian attack worked on so many users of Google! –  Rory Alsop Jan 13 '11 at 13:42
    
@Arjan - I have carried out MITM attacks very simply as part of my day job. And I have had to help organisations with technical controls as well as user and customer education. It is a very real issue, and one that claims many victims. Most users (ie not superusers) have so many warnings and notices they don't understand that they do not notice a cert warning and just click! –  Rory Alsop Jan 13 '11 at 13:52
    
@Arjan - updated. Hopefully better wording? –  Rory Alsop Jan 13 '11 at 14:30
1  
I deleted some comments, now orphaning @weeheavy's comment a bit, in which "wrong" was directed towards me, not towards the answer: those appliances can only work in corporate environments, where the browser has been set up to accept fake certificates. –  Arjan Jan 13 '11 at 15:22
show 2 more comments

Sure, your ISP (or someone else using their equipment without permission, which is a serious risk in and of itself) could read unencrypted data that goes through their network. Typically, unencrypted traffic includes e-mail, web, and FTP traffic unless specifically encrypted using SSL or TLS, as in the HTTPS protocol.

Also typically, your ISP would prefer that at the very least, the passwords you send over the internet (in particular, for their e-mail accounts) are encrypted, so as to prevent attackers from compromising a router somewhere - like your wireless router with the default password - and gaining access to their servers. While the government could force an ISP to listen to your traffic for their purposes, a much greater threat to you exists from people who would love to steal your private information and/or money.

share|improve this answer
add comment

Not directly an answer to your question, but passwords are more often stolen using either a keylogger (software illicitly installed on your PC that records all your keystrokes) or social engineering, such as phishing. (Phishing is sending email that tricks you into logging into a "fake version" of Facebook or whatever, thus revealing your password to the phishers, and then redirecting you to the real one. Most victims don't even realize at first what has happened.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.