4

When I use Google Talk over https://gmail.com can anyone read (sniff) my messages?

1
  • 1
    as it's using https, no. not without cracking the ssl encryption, which in this context isn't feasable.
    – Sirex
    Aug 17, 2011 at 9:06

2 Answers 2

6

No.

Whenever you're using a HTTPS connection with a valid certificate to connect to a server you trust, every bit of content sent over this channel is encrypted using SSL/TLS.

If you are on a channel where it is easy to sniff the sent data, i.e. on a switched LAN or on an unsecured WiFi network, an attacker could only see the encrypted data and not the plain text you are sending.

Take a look at the security information your browser shows you:

enter image description here

Here are the relevant bits:

  • The certificate is valid and signed by a well known authority (Thawte)
  • The connection is encrypted with TLS 1.0, however it loads some unsecured content as well (for example these could be static images like the Gmail logo)
  • The connection is encryped with 128-bit, which can't really be compromised as of today
5
  • So, can attacker or a software crack encyrepted datas or can a firewall monitor messages which that works on LAN?
    – Kerberos
    Aug 17, 2011 at 10:46
  • 1
    No. The encryption method used is too strong to be cracked. The only thing you should care about is whether you can trust the certificate of the site you're on.
    – slhck
    Aug 17, 2011 at 10:50
  • 1
    +1 for a great answer. In addition to this, Google (like many other online communications services companies) "may retain your communications" -- see the "User communications" point in Google's Privacy Policy document for the list of conditions (it doesn't specify how long they will retain information, which is also common): google.com/privacy/privacy-policy.html Aug 17, 2011 at 10:50
  • 1
    Thanks for adding that, @Randolf -- I was talking about the more general case here, but it's interesting to have the official Google policy here.
    – slhck
    Aug 17, 2011 at 10:51
  • The firewall won't be able to read the message either. The encryption happens at your own computer and then the encrypted data is encapsulated. The firewall will, however, be able to see information such as the source and destination addresses and ports. Without those being in plain clear text the Internet would be unable to route the data.
    – Jack
    May 31, 2013 at 19:53
0

Not generally, but it doesn't mean that someone is not viewing or storing the conversation. Since the connection is encrypted, it will not be captured in transit, but if you are using a company computer, and they are using a monitoring application like Spector 360 from SpectorSoft, either on your end or the other, than that conversation can be recorded and stored.

SpectorSoft Spector 360

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.