1

When I am using public WiFi to go to a secured site that uses HTTPS, is my data encrypted? Is it a lot more risky than when I am on a secured network ?

  • 1
    Ad-hoc or access point? – Ry- Dec 16 '11 at 21:14
4

Your data is encrypted by the SSL crypto, but anyone on the network (and that means pretty much anyone, on public unsecured wifi) can sniff the traffic. How secure it is depends on the crypto of the browser you're using and the server you're communicating with, as SSL will fall back to the lowest common cryptographic denominator.

Also keep in mind that some SSL cryptography has been compromised.

For many purposes, though, the SSL encryption will keep your data private enough. If you're hiding holiday present details from the recipient you're probably ok, but if you're transmitting illicit government secrets you might want to find a more secure network.

One thing of note, unless all your traffic with the website at the other end is encrypted, once you've established credentials with the site if the rest of your session on the site is unencrypted your cookie-based authentication with the site will be out in the open for all to see. It's not that unusual for sites only to encrypt the data they think is risky when you acquire it but then to use unsecured HTTP for the rest of the session, thereby exposing your cookies (and your identity and authentication on the site) out in the open.

| improve this answer | |
  • 4
    You can't replay TLS traffic. The server uses a new random number in every handshake, the client has to use this number in the subsequent handshake. TLS would be really stupid if it permitted replays. – erickson Dec 16 '11 at 22:16
  • 1
    Can you provide a source for your claim that replay attacks of SSL/TLS are possible? – CodesInChaos Dec 16 '11 at 22:19
  • 1
    This question links has some details about TLS and replays and links to the specs. Only poorly implemented clients/servers would be vulnerable though, which should not include standard browsers. Replays usually are not possible, unless someone has screwed up or found a bug. security.stackexchange.com/questions/3664/… – Zoredache Dec 16 '11 at 23:29
  • No, indeed, I was mistaken, as is (apparently) well-documented. Answer corrected - thanks for pointing out my error! – cori Dec 16 '11 at 23:45
1

Yes, the HTTPS use SSL. A security Layer.

It encrypt the exchange between your computer and the server. But like every encryption. It's hackable. But it takes really long time.

Except if you are a secret agent, this security is enough.

| improve this answer | |
0

HTTPS is to avoid MiTM attacks, just be aware that if there is a warning you are must likely under attack.

If you are concerned with your privacy, then set up an SSH Tunnel or buy a VPN.

| improve this answer | |
0

If you use HTTPS, the actual web pages are transmitted encrypted, but anyone with access to the same WiFi network can see data such as

  • DNS requests
  • hostnames of sites you visit due to Server Name Indication (SNI)
  • the amount of data you transfer from/to specific IP addresses

(WPA2 Enterprise may make sniffing for other users impossible, but that’s unlikely to be used for a public WiFi and doesn’t prevent the network owner to do such things.)

For better security you should use a VPN. Then the only things other people on the same WiFi should be able to see are the host name (due to the DNS lookup) of your VPN, its IP address and the amount of data you transfer to/from your VPN. There may be additional data leakage when your operating system or a program tries to transmit data while the VPN is not yet connected so the routes are not set up yet. On Android devices there is a setting to block data transfers while not connected to a VPN.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy