Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I am using public WiFi to go to a secured site that uses HTTPS, is my data encrypted? Is it a lot more risky than when I am on a secured network ?

share|improve this question

migrated from Dec 16 '11 at 21:50

This question came from our site for professional and enthusiast programmers.

Ad-hoc or access point? – Ryan O'Hara Dec 16 '11 at 21:14

Your data is encrypted by the SSL crypto, but anyone on the network (and that means pretty much anyone, on public unsecured wifi) can sniff the traffic. How secure it is depends on the crypto of the browser you're using and the server you're communicating with, as SSL will fall back to the lowest common cryptographic denominator.

Also keep in mind that some SSL cryptography has been compromised.

For many purposes, though, the SSL encryption will keep your data private enough. If you're hiding holiday present details from the recipient you're probably ok, but if you're transmitting illicit government secrets you might want to find a more secure network.

One thing of note, unless all your traffic with the website at the other end is encrypted, once you've established credentials with the site if the rest of your session on the site is unencrypted your cookie-based authentication with the site will be out in the open for all to see. It's not that unusual for sites only to encrypt the data they think is risky when you acquire it but then to use unsecured HTTP for the rest of the session, thereby exposing your cookies (and your identity and authentication on the site) out in the open.

share|improve this answer
You can't replay TLS traffic. The server uses a new random number in every handshake, the client has to use this number in the subsequent handshake. TLS would be really stupid if it permitted replays. – erickson Dec 16 '11 at 22:16
Can you provide a source for your claim that replay attacks of SSL/TLS are possible? – CodesInChaos Dec 16 '11 at 22:19
This question links has some details about TLS and replays and links to the specs. Only poorly implemented clients/servers would be vulnerable though, which should not include standard browsers. Replays usually are not possible, unless someone has screwed up or found a bug.… – Zoredache Dec 16 '11 at 23:29
No, indeed, I was mistaken, as is (apparently) well-documented. Answer corrected - thanks for pointing out my error! – cori Dec 16 '11 at 23:45

Yes, the HTTPS use SSL. A security Layer.

It encrypt the exchange between your computer and the server. But like every encryption. It's hackable. But it takes really long time. ;)

Except if you are a secret agent, this security is enough. ;)

share|improve this answer

HTTPS is to avoid MiTM attacks, just be aware that if there is a warning you are must likely under attack.

If you are concerned with your privacy, then set up an SSH Tunnel or buy a VPN.

share|improve this answer

You must log in to answer this question.