As long as you don't blithly accept new ssh connection end points or bypass certificate warnings, you should be fine. They could track where you go online via

As long as you don't blithly accept new ssh connection end points or bypass certificate warnings, you should be fine. They could track where you go online via the DNS requests ( the sites at least ), and they could mess with anything unencrypted. Used to be if an HTTPS site loaded an HTTP script resource it provided a dangerous place middlemen could invade your secure session. chrome, IE ( presumably now Edge as well ) and firefox rightfully block mixed content by default, and have for some time https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_... ( the mentioned Firefox 23 came out in 2013, so like I said, a while )