3 ms·

Honest question, who is in a position to tap your connection such that this becomes a serious security concern? IT staff at your company? The admins at your ISP

Honest question, who is in a position to tap your connection such that this becomes a serious security concern? IT staff at your company? The admins at your ISP? The NSA? I'm assuming that public wifi has session-specific encryption keys. I don't see these as the kinds of concerns that would warrant the kind of panic that some people seem to show over HTTP.

shazow 10y ago
> I'm assuming that public wifi has session-specific encryption keys. That's false for open wifi networks. Remember Firesheep? Just fire it up at your local coffeeshop and off you go. Even for more secure public wifi like WPA2, vast majority of coffeeshops still don't change the default router admin passwords so you can take over it easily and listen in on all the traffic. Further, it's not hard for some rando to setup a safe-looking access point and get people to connect to it. Camp out near an office with a router, I'm sure you'd get plenty of hits. There's no shortage of attack vectors with no warrants required.
deleted 10y ago
[deleted]
BinaryIdiot 10y ago
> who is in a position to tap your connection such that this becomes a serious security concern? When you use HTTP everything is sent in plain text. This means... - Anyone on the same network as you can see all of your traffic. This includes company networks, coffee shop wifi, your house, the library; any place that has a WiFi network. Caveat: it's possible to use network isolation to hide your traffic but this is crazy rare to see and typically is done to isolate networks, not individual traffic. - Your ISP can see and log everything sent over HTTP. - Anyone at the router level that your traffic passes through. Your traffic makes a lot of hopes over various routers on the internet before making it to your final destination. Overall it's a terrible idea for anything that needs to be sent securely.
- ec109685 10y ago
  If I have two devices connected to a switch, how can they see each other's traffic?
  - datguacdoh 10y ago
    Just download Wireshark and you'll have an easy to use tool that'll show you the traffic.
    - windowsworkstoo 10y ago
      Not by default, only if you do ARP poisoning, which most consumer switches wont guard against. All you'll see without it is broadcast crap.
  - icebraining 10y ago
    ARP poisoning[1]. Ettercap lets you do it with a couple of clicks, without any advanced knowledge. [1] https://en.wikipedia.org/wiki/ARP_spoofing https://en.wikipedia.org/wiki/ARP_spoofing
Klathmon 10y ago
HTTPS isn't just about encryption either. It's about authentication and integrity as well. Making sure the server you are talking to is the correct one, and making sure that nobody along the way injects ads, trackers, malware, or anything else.
mikeash 10y ago
Your assumption about public wifi is wrong. If you connect without a password, your traffic is sent in the clear and MITM attacks are trivial. If you don't want your password exposed to any hacker with an old Pringles can within a mile of your location, you need end to end crypto.
- hackinthebochs 10y ago
  Good to know, thanks. That seems rather negligent that per session encryption wasn't built into the protocol.
  - mikeash 10y ago
    Agreed. I can see why you would assume there would be. Seems like the obvious thing to do.
ilogik 10y ago
https://hakshop.com/products/wifi-pineapple?variant=17846178757 https://hakshop.com/products/wifi-pineapple?variant=17846178...

shazow 10y ago

> I'm assuming that public wifi has session-specific encryption keys. That's false for open wifi networks. Remember Firesheep? Just fire it up at your local coffeeshop and off you go. Even for more secure public wifi like WPA2, vast majority of coffeeshops still don't change the default router admin passwords so you can take over it easily and listen in on all the traffic. Further, it's not hard for some rando to setup a safe-looking access point and get people to connect to it. Camp out near an office with a router, I'm sure you'd get plenty of hits. There's no shortage of attack vectors with no warrants required.

deleted 10y ago

[deleted]

BinaryIdiot 10y ago

> who is in a position to tap your connection such that this becomes a serious security concern? When you use HTTP everything is sent in plain text. This means... - Anyone on the same network as you can see all of your traffic. This includes company networks, coffee shop wifi, your house, the library; any place that has a WiFi network. Caveat: it's possible to use network isolation to hide your traffic but this is crazy rare to see and typically is done to isolate networks, not individual traffic. - Your ISP can see and log everything sent over HTTP. - Anyone at the router level that your traffic passes through. Your traffic makes a lot of hopes over various routers on the internet before making it to your final destination. Overall it's a terrible idea for anything that needs to be sent securely.

ec109685 10y ago
If I have two devices connected to a switch, how can they see each other's traffic?
- datguacdoh 10y ago
  Just download Wireshark and you'll have an easy to use tool that'll show you the traffic.
  - windowsworkstoo 10y ago
    Not by default, only if you do ARP poisoning, which most consumer switches wont guard against. All you'll see without it is broadcast crap.
- icebraining 10y ago
  ARP poisoning[1]. Ettercap lets you do it with a couple of clicks, without any advanced knowledge. [1] https://en.wikipedia.org/wiki/ARP_spoofing https://en.wikipedia.org/wiki/ARP_spoofing

Klathmon 10y ago

HTTPS isn't just about encryption either. It's about authentication and integrity as well. Making sure the server you are talking to is the correct one, and making sure that nobody along the way injects ads, trackers, malware, or anything else.

mikeash 10y ago

Your assumption about public wifi is wrong. If you connect without a password, your traffic is sent in the clear and MITM attacks are trivial. If you don't want your password exposed to any hacker with an old Pringles can within a mile of your location, you need end to end crypto.

hackinthebochs 10y ago
Good to know, thanks. That seems rather negligent that per session encryption wasn't built into the protocol.
- mikeash 10y ago
  Agreed. I can see why you would assume there would be. Seems like the obvious thing to do.

ilogik 10y ago

https://hakshop.com/products/wifi-pineapple?variant=17846178757 https://hakshop.com/products/wifi-pineapple?variant=17846178...