Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let us say that I have a client and a server communicating using SSL.

If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?

share|improve this question

Depends. In general, no. If the attacker launches a man-in-the-middle attack after HTTPS communication has already started, he can do nothing.

If he launches the attack beforehand, he can do various things. For convenience, let's assume that the server in question is GMail.

  • Pretend to be This is a pretty transparent attack. The attacker cannot obtain a trusted signature for his SSL cert, and thus cannot pretend to be Google without throwing an error similar to this one. If the client clicks through this; well, that's the client's fault.
  • Catch you when you try HTTP: Some people enter, which means that their browser will first try HTTP. Most HTTPS-only sites issue a 301 Moved Permanently redirect, but an attacker can stop this from happening and pretend to be HTTP-GMail (and pretend to be you in communications with the real HTTPS GMail -- individuals don't have/need SSL certs so this impersonation is easily done once your password is with the attacker). Note that the browser icon will no longer have a green padlock in such a case. However, not all mobile browsers visually distinguish between HTTP and HTTPS. Generally it is better to use bookmarks and save history on the client side, and use HSTS on the server side to protect against this.

There used to be many other HTTPS implementation vulnerabilities (they're pretty much all fixed now). There probably still are a few. But most rely on the user not noticing (or blindly clicking through) a warning.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.