Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 5 down vote favorite

If someone is monitoring all of the traffic on a network, and then I connect to it, and log into a website that is protected with SSL - is there any security risk?

share|improve this question

2 Answers

up vote 9 down vote accepted

Some, but there is risk everywhere. Practically, as long as the site is using complete SSL NOT mixed mode(login with SSL but goes back to not SSL after login), you shouldn't have any issues.

share|improve this answer
4  
To elaborate on this some, the site must be using an SSL certificate issued by a legitimate and trusted CA (if it is, your browser will silently accept it), and you must make sure that you don't ignore any warnings that the certificate may not be legit. If the site is using a self-signed certificate, an expired certificate, or one that is issued by a CA your browser doesn't know/trust, verifying that you're connected to the site and not an attacker's computer becomes extremely difficult. – Kromey May 20 '11 at 16:51
@Kromey True enough. And make sure your using a modern browser. – Jeff F. May 20 '11 at 17:24
3  
For what its worth, there are concerns about the "chain of trust" concept used by the CA system, as it turns out that several smaller CAs have been issuing incorrect certificates for major websites. You aren't likely to be affected, but it is possible. – Lukasa May 20 '11 at 17:24
@Lukasa True, but exploiting this would require quite the conspiracy and there are easier ways to gain access to data. – Jeff F. May 20 '11 at 17:27
@ Jeff F.: Oh, absolutely, and I don't spend my day-to-day life panicking about every SSL certificate I see. Nevertheless, it is worth noting that an SSL-based impersonation is not theoretical. – Lukasa May 20 '11 at 17:33
show 1 more comment
up vote 0 down vote

If you haven't pruned the CA root list in your browser then you shouldn't feel great about having privacy from government entities - otherwise if your system is patched/current and so is the sever's and you are doing reasonable validity checking (expiration, chain validity, certificate status) you are probably in reasonable shape against unsophisticated attackers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.