5

If someone is monitoring all of the traffic on a network, and then I connect to it, and log into a website that is protected with SSL - is there any security risk?

9

Some, but there is risk everywhere.

Extra diligence is required, however, to ensure that your certificate is valid.

Never accept a self-signed or expired certificate in this scenario(you'll see security warnings from modern browsers). Click on the lock next to your URL to ensure everything looks good!

Ensure the the site is using complete SSL and not mixed mode(Some elements encrypted others not or login via HTTPS and pop back to HTTP after) and you should be alright to use it.

| improve this answer | |
  • 5
    To elaborate on this some, the site must be using an SSL certificate issued by a legitimate and trusted CA (if it is, your browser will silently accept it), and you must make sure that you don't ignore any warnings that the certificate may not be legit. If the site is using a self-signed certificate, an expired certificate, or one that is issued by a CA your browser doesn't know/trust, verifying that you're connected to the site and not an attacker's computer becomes extremely difficult. – Kromey May 20 '11 at 16:51
  • @Kromey True enough. And make sure your using a modern browser. – Jeff F. May 20 '11 at 17:24
  • 3
    For what its worth, there are concerns about the "chain of trust" concept used by the CA system, as it turns out that several smaller CAs have been issuing incorrect certificates for major websites. You aren't likely to be affected, but it is possible. – Lukasa May 20 '11 at 17:24
  • @Lukasa True, but exploiting this would require quite the conspiracy and there are easier ways to gain access to data. – Jeff F. May 20 '11 at 17:27
  • @ Jeff F.: Oh, absolutely, and I don't spend my day-to-day life panicking about every SSL certificate I see. Nevertheless, it is worth noting that an SSL-based impersonation is not theoretical. – Lukasa May 20 '11 at 17:33
0

If you haven't pruned the CA root list in your browser then you shouldn't feel great about having privacy from government entities - otherwise if your system is patched/current and so is the sever's and you are doing reasonable validity checking (expiration, chain validity, certificate status) you are probably in reasonable shape against unsophisticated attackers.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.