up vote 1 down vote favorite
share [g+] share [fb]

When I am using public WiFi to go to a secured site that uses HTTPS, is my data encrypted? Is it a lot more risky than when I am on a secured network ?

link|improve this question
1  
Ad-hoc or access point? – minitech Dec 16 '11 at 21:14
feedback

migrated from stackoverflow.com Dec 16 '11 at 21:50

This question came from our site for professional and enthusiast programmers.

4 Answers

up vote 3 down vote

Your data is encrypted by the SSL crypto, but anyone on the network (and that means pretty much anyone, on public unsecured wifi) can sniff the traffic. How secure it is depends on the crypto of the browser you're using and the server you're communicating with, as SSL will fall back to the lowest common cryptographic denominator.

Also keep in mind that some SSL cryptography has been compromised.

For many purposes, though, the SSL encryption will keep your data private enough. If you're hiding holiday present details from the recipient you're probably ok, but if you're transmitting illicit government secrets you might want to find a more secure network.

One thing of note, unless all your traffic with the website at the other end is encrypted, once you've established credentials with the site if the rest of your session on the site is unencrypted your cookie-based authentication with the site will be out in the open for all to see. It's not that unusual for sites only to encrypt the data they think is risky when you acquire it but then to use unsecured HTTP for the rest of the session, thereby exposing your cookies (and your identity and authentication on the site) out in the open.

link|improve this answer
4  
You can't replay TLS traffic. The server uses a new random number in every handshake, the client has to use this number in the subsequent handshake. TLS would be really stupid if it permitted replays. – erickson Dec 16 '11 at 22:16
1  
Can you provide a source for your claim that replay attacks of SSL/TLS are possible? – CodeInChaos Dec 16 '11 at 22:19
1  
This question links has some details about TLS and replays and links to the specs. Only poorly implemented clients/servers would be vulnerable though, which should not include standard browsers. Replays usually are not possible, unless someone has screwed up or found a bug. security.stackexchange.com/questions/3664/… – Zoredache Dec 16 '11 at 23:29
No, indeed, I was mistaken, as is (apparently) well-documented. Answer corrected - thanks for pointing out my error! – cori Dec 16 '11 at 23:45
feedback
up vote 1 down vote

Yes, the HTTPS use SSL. A security Layer.

It encrypt the exchange between your computer and the server. But like every encryption. It's hackable. But it takes really long time. ;)

Except if you are a secret agent, this security is enough. ;)

link|improve this answer
feedback
up vote 0 down vote

HTTPS is to avoid MiTM attacks, just be aware that if there is a warning you are must likely under attack.

If you are concerned with your privacy, then set up an SSH Tunnel or buy a VPN.

link|improve this answer
feedback
up vote -2 down vote

If you are on a public wireless router that is unsecure your cookies can be stolen and then used to impersonate you. Your transactions are secure in that no one can see what you are doing, HOWEVER, you are NOT secure in that people can mimic your credentials with the data you are sending.

link|improve this answer
1  
that's not the case if you're communicating with SSL unless someone with access to the traffic can crack the crypto or one end of the stream is untrustworthy. Cookies are encrypted along with everything else. – cori Dec 16 '11 at 21:24
2  
Doesn't matter if they are encrypted, duplication doesn't need to change anything. There is even a FireFox extention, FireSheep, which allows you to do just what I am talking about. Sorry cori, but that IS the case - no cracking needed. – Travis J Dec 16 '11 at 21:27
1  
Ah I see what you're saying - agreed. – cori Dec 16 '11 at 21:28
You can't replay TLS traffic. – erickson Dec 16 '11 at 22:17
I don't think this is true for SSL/TLS protected traffic. AFAIK You can't replay an entire TLS session, because the server sends a random number during the handshake that influences the encryption keys, which will be different when the attacker tries to imitate that session. – CodeInChaos Dec 16 '11 at 22:19
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard