Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose I log into a website, such as Twitter, from a 3G-enabled smartphone or similar device. How secure is this from interception? Can someone steal my password or login?

What if I use HTTPS? What if my device can only get a 2G signal or similar? Does it differ by country?

share|improve this question
add comment

4 Answers

up vote 11 down vote accepted

For HTTP, you rely on nobody being able to spy on your packets (or alter/drop/duplicate them) between your device (your smartphone or computer) and the target server. 2G and 3G offer some encryption, but only from your device to the nearest base station; encryption is "over the air". From the base station to the target server, there is no encryption (or, at least, nothing is standard-enforced), so you cannot assume that the data is protected. Besides, the 2G encryption is based on A5/1, which is known to be weak (and there are ways to force a given cell phone to switch back to A5/2, which is weak by design, and can be cracked in real-time). 3G uses KASUMI which, while academically weakened, is still beyond cracking with today's technology. However, I repeat, 2G/3G encryption is only against nearby adversaries, who limit themselves to the radio link between your device and the station. Don't use HTTP for transfers of valuable data.

HTTPS is HTTP-within-SSL. SSL has been designed to offer security (server authentication, confidentiality and data integrity) regardless of the transport medium. 2G/3G is irrelevant to the security of HTTPS. It depends on your borwser / operating system (and, in particular, which certification authorities is accepts as "trusted roots"), not on the network.

share|improve this answer
add comment

If HTTPS is being used, regardless of what the carrier network is, the functionality is the same. So, even if someone can actually sniff data that you send over 3G, they would have to do the same amount of work they would have to do to decrypt it when they get the encrypted data on an ethernet cable. This currently cannot be done. Hence, to answer your question, using HTTPS is secure and it does not differ by country.

On the other hand, if a simple HTTP connection is used, per http://serverfault.com/questions/311873/can-3g-networks-be-packet-sniffed-analyzed then definitely anyone can see your credentials.

share|improve this answer
1  
not to mention, the server end probably isn't on the same 3G network, so that is http/https the same across the open net the same as your broadband connection. –  ewanm89 Oct 10 '12 at 0:40
add comment

The HTTP or HTTPS protocol will be just as secure over 3G as with any other type of network (WiFi, wired, etc).

As ewanm89 points out, the 3G portion of the connection is only between your device and the phone network. Packets will still be sent between the phone network and the remaining servers along the path to the server you are trying to reach. If these packets are unencrypted then anyone along that route can potentially steal your credentials.

All things being equal, the country you are connecting from should not matter, unless a country were to take extreme measures such as blocking HTTPS.

share|improve this answer
add comment

3G (and even 2G) data transfer is already encrypted, so HTTPS does not add any security benefits. Nothing to worry about, it is much more secure than, say WEP.

2G's encryption has been cracked before, but I am not sure how much effort that takes.

The only interception that can happen if you use HTTP over 3G is by your mobile network operator, for, say, lawful interception purposes, if the government asks them. HTTPS should stop even that.

share|improve this answer
    
More secure than WEP is a weak argument, though. Apparently many weaknesses have been identified in the 3G cipher: en.wikipedia.org/wiki/3G#Security –  Justin Ethier Oct 10 '12 at 13:39
    
HTTPS adds huge security benefits, even when the connection is already encrypted. 3G is decrypted somewhere on the mobile carrier's network. After that, it's all in the clear for governments and transit providers to pick up on. Also HTTP does not provide authentication of any form, the server you are talking to could be any random server on the internet. And lastly, the mobile carrier themselves hold the decryption key, they (or an employee) could be reading/modifying the connection. –  Luc Oct 10 '12 at 20:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.