For instance, how would I check that YouTube for Android uses transport layer security TLS encryption?
Is there a network tool I can use to verify that encryption is used?
migrated from security.stackexchange.com May 15 '14 at 7:36
This question came from our site for information security professionals.
You can test by connecting to a Wireless network you control and using a sniffer (wireshark, tcpdump) on the wired side of the AP to watch the packets go through. While Android should prefer wireless over phone network, you can disable phone data services if it isn't doing so.
Let us know what you find!
To test you need to capture network packets from wireshark or a similar tool. This can be run on your phone if you have rooted your phone. Alternatively, you can take an internet connected computer and setup an unused wifi/bluetooth card as a wifi/bluetooth hotspot (e.g., setup a wifi hotspot when the computer is directly connected to the internet through ethernet, or setup a bluetooth connection that shares internet between your phone and laptop if your laptop is connected to the internet through wifi). Then connect your phone to your laptops internet and start your wireshark capture. Then start up the particular mobile application and use it. Try not to have your computer or phone to have too much other internet activity at the time you are doing the capture. Filter through the collected packets by IP address (e.g., if you are looking up youtube, look at IPs that are associated with youtube). Check that everything generated by the application is sent over using TLS (note the protocol). See if data you want to keep secret is being sent unencrypted.
For the specific case of youtube app on android. No, the video and initial request to get a video is sent over unencrypted HTTP. (I just tested with wireshark using the youtube app on my nexus 7 running Android 4.4.2.) It does make an initial HTTPS connection, which I believe is used for logging you into your google account. However, when you request and watch a video, the traffic including the HTTP header that identifies the video is sent over unencrypted HTTP. The following is a captured HTTP request made at the start of TCP stream made with the youtube app (granted I altered my ip, and many of the other fields with fake data, so I didn't inadvertantly leak information like an active google session cookie, that I do not want to send). Note the
This was when I was watching the video:
Note these two ids correspond with each other; one is the video id encoded in (modified) base64, and the other is the video id encoded in a hexadecimal. Going into python, you can show that they are identical:
Alternatively to go the other way:
So it is possible for a network eavesdropper to note what videos you are watching over the youtube mobile application.