Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Assume that we have a user that wants to connect to the server, for example with login page, when user submits the username & password goes to the server - if man in the middle reads the user & pass, can he connect to server or there are mechanisms that can prevent this?

share|improve this question
updated as this is not a crypto question – Rory Alsop Mar 16 '13 at 17:58
up vote 5 down vote accepted

If you only have username+password authentication, and this login info is intercepted, you cannot realistically block the attacker from connecting. You have to look into two-factor authentication to prevent attackers from reusing login credentials etc. And even then, when the attacker has continued access to all traffic, this will not help at all.

If you don't use https, the attacker can also simply intercept all traffic, so even if you can prevent him from logging in himself, no information is actually protected.

share|improve this answer

If you're using HTTPS with a valid certificate and your application is protected from XSS then there's no reason to think that MITM will be able to see the submitted username and password.

If you're using HTTP then you can consider any login credentials for any user compromised. You should stop thinking of extra access control methods and start fixing this situation, start using HTTPS.

Have you fixed the HTTPS situation? Alright, good, now continue reading.

One area you could look at is using specious-activity detection. If the user suddenly logs in from the a different city/country, or if he starts using a different OS and/or browser. Depending on the sensitivity of the accounts, you could lockup and then send a verification code via email/SMS/physical mail.

share|improve this answer

I'd assume 'the login page' is the http protocol.

In normal cases 'the attacker' can then connect the to server. I have tried this in some networks.

A solution is to restrict a certain number of MAC addresses of the devices that can access your Network. This can be usually configured in the router configuration.

The only problem for that is that it's not very convenient for the admin of the network, because he has to add/delete the MAC addresses all the time.

share|improve this answer
A MITM attacker can also intercept and spoof the MAC address, so that wouldn't help in this scenario. – Joel L Mar 16 '13 at 13:46
thanks for your replay, but it is true when we are in a LAN, if we assume that this http page(login page) is a website, we can not work on MAC addresses. – Ali Mar 16 '13 at 13:51
I'd have to admit, that's true @JoelL – nixor01 Mar 16 '13 at 14:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.