I'm staying at a friend's place for a few days and use his wifi. Can he tell what websites I visit? His wifi is password protected (WPA2). Note: my friend is a software engineer.

I have read stuff about Wireshark and other tools but something bugs me: surely wifi box makers want wifi to be secure, so that employees in a company or family members don't "spy" on each others. So would my friend be able to see what urls I connect to?


It's certainly possible. His router has complete control over routing traffic on his network, which would let him at least see the names of the sites you connect to through DNS requests your device(s) make. It's less likely he'd be able to see information those sites display, though.

Unless you use something like a VPN, in which case all he would see is a connection to a VPN. That said, if you're concerned about him possibly spying on you, perhaps you shouldn't be staying with him.

| improve this answer | |

I NOTE THIS IS ALL WHAT CAN BE DONE - NOT AN INDICATION ITS EASY OR LIKELY. Most non-experts could not what you are asking, and many experts won't.

Its your friends network, so yes, if he has the technical nous and is so inclined he can spy on you in a limited way if he has set his network up to do so. I'll break it down -

It is his network, so the level of WIFI security is irrelevant - he knows the passphrase, and even if he doesn't - just like any ISP or provider between you and the sites you visit, he can get access to the data after it has left the WIFI network and is transiting his router.

Most websites now use HTTPS, and this does offer you some protection against spying. A rough and very simplistic general assessment is he will be able to see what sites you visit, but not exactly what pages. (Unless he manages to install his own certificate on your computer or you ignore computer warnings about untrusted certs). There are at least 2 ways he can gleen this information - By looking through the DNS requests your system makes, and by looking at the headers. Although sites are encrypted with HTTPS, most often the information about the site address is not encrypted due to limitations of having multiple secure sites on a single server/IP address.

Using a VPN will allow you to encrypt all traffic between your computer and him, and will overcome the shortcomings above - if you are careful not to use his nameservers - which is sometimes not obvious. Of-course, the VPN provider can get the data instead of him.

There is another attack vector - as you are at his place, he can likely get access to your hardware. Once he can do this he can install a key logger or other means of getting access to your systems. You may want to google "Evil Maid attack" for this class of problem.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.