Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how can I secure myself?

share|improve this question
Even if you use a proxy service, that service would be unable to harvest your passwords, unless you were actually using them to make the secure connection. If thats the case then nothing you do can protect your passwords considering the traffic at that point is basically not encrypted. – Ramhound Jan 24 at 17:57

2 Answers

up vote 5 down vote accepted

Your ISP can know your password any time it's sent unencrypted over your internet connection. If you don't want them to know your password, don't send it unencrypted over the internet:

  • Avoid login pages that use HTTP (always use HTTPS and don't visit sites with expired or invalid SSL certificates)
  • Don't use FTP or other services/protocols that don't encrypt your password in transit

Also follow general security guidelines for passwords, such as never reusing the same password.

Additionally, if you are worried that your ISP (or anybody else in between you and the remote server you're communicating with) is watching you, then you also need to take additional steps, such as:

  • Ensuring that all websites you are logged in to are using HTTPS, so that your cookies can't be snatched from the HTTP request (you're logged in to this site, where HTTPS isn't available, so your ISP can already log in as you here if they want to)
  • Verifying you are talking to the right server (for example, with SSH, ensure you use fingerprint verification and take notice if a server's fingerprint changes).

If you are only worried about your ISP (or your government), you can improve your position significantly by using an offshore VPN so that all of your traffic is routed through a server outside of their reach. Your data will still be sent unencrypted over the internet, but will be encrypted between the VPN and you, which is enough to prevent your ISP from reading it.

share|improve this answer
I should add that if you don't trust your government, you probably shouldn't trust the PKI (your government probably runs a root CA or can compel a root CA to sign a fake cert). – Tom Marthenal Jan 21 at 4:58
up vote 0 down vote

If you are not using HTTPS, then your passwords are at risk of interception. Using a VPN or an encrypted proxy means trusting the VPN and proxy provider. Only HTTPS can provide (as far as we know) reliable security without trusting anyone external. But attacks that weaken the SSL/TLS protocol exist, such as BEAST, CRIME and TIME.

You have to make sure your are using HTTPS on websites that have your sensitive data. Banks and Google will use HTTPS but for others, you have to configure them to use HTTPS. Facebook is a website that doesn't yet have HTTPS for everyone by default but you can turn it on using a few clicks.

HTTPS Everywhere is a Firefox and Chrome extension that encrypts your communications with many major websites, making your browsing more secure. "HTTPS Everywhere" makes sure you will not use the unsafe HTTP when HTTPS is available.

share|improve this answer
Even with HTTPS, you still need to trust the root certificate authority, and their key-signing process and security. – Adam McKissock Jan 20 at 21:35
You're completely right, I failed to mention that, but it might be too in-depth for the scope of this explanation. – Cristian Dobre Jan 20 at 22:17
@CristianDobre - You really shouldn't have to explain that part of the equation, since in this context, your only telling readers that a secured connection should be used. – Ramhound Jan 24 at 17:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.