Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic.

Will that prevent ISP and potential mans in the middle from spying on the traffic?

share|improve this question

It will stop them reading the content of the traffic, but they will know the destination from when the TCP connection is set up; The IP address of the recipient cannot be encrypted when the connection is created otherwise the ISP's routers wouldn't know where to send the traffic. The content will be secured though.

If you want an extra layer of protection and you're really paranoid, look into tor, which will allow all traffic and its destination and source to be obscured.

share|improve this answer

The previous answer is right as far as ISPs are concerned, but if you replace "ISP" with "employer", the answer is emphatically NO, assuming that your employer has administrative or physical access to your machine (especially if its a Windows box on a domain). In that case, your employer can add new CA certs to your browser without your knowledge. This enables a Man-in-the-Middle attack on TLS by TLS/SSL interceptors (such as made by companies like Bluecoat). These interceptors decrypt your TLS/SSL traffic on the way out of and into the company.

share|improve this answer
I would add that using Tor is a great idea, and can defeat TLS/SSL interceptors. – Fran Jun 2 '12 at 18:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.