Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I live with someone in the same house so we both use the same wifi. He knows the wep password because he set it up in the first place. He's not a hacker but he can set the wifi system at home. He has some computer knowledge from college.

Can he actually see the websites I visited? The URLs? What else can he see?

You mean he can actually see these things without having to hack? So this kind of information is not only available to hackers?

share|improve this question

marked as duplicate by Terry Chia, NULLZ, TildalWave, Adi, Rory Alsop Oct 5 '13 at 13:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

He knows the wep password because he set it up in the first place.

Firstly, WEP? If you are using WEP, anyone who knows how to download some tools and owns a laptop will be able to see your network traffic. WEP is terrible.

Can he actually see the websites I visited? The URLs? What else can he see?

Basically, if the guy is on the same network as you, he can see everything you do. If the websites you are visiting is being served through HTTPS, he will not be able to see the exact data you are sending but he will still be able to tell where and when you visit the site.

share|improve this answer
I don't understand. How does he see what websites I've been visiting on his own computer? – Lavin Oct 5 '13 at 3:07
If he does MITM, this is hacking, right? Can anybody do this, not just hackers? What if he's not a hacker and has no malicious intent? It's more like I'm just paranoid. – Lavin Oct 5 '13 at 3:45
He does have to set up something in order to know which websites I visited, right? Knowing the password alone is not enough, right? Is this something tedious to set-up for a non-hacker? – Lavin Oct 5 '13 at 3:48
He doesn't live here anymore. – Lavin Oct 5 '13 at 6:24
@Lavin So change the password... – Terry Chia Oct 5 '13 at 6:25

Terry has already answered your question, but I'd like to provide more information.

The type of WiFi security is only a side issue. The main issue is that you are using a network that he controls. Presumably he controls the router, switches, and access points.

Therefore, even if the WiFi network used WPA2, your network traffic would still be vulnerable to intercept at the network level. One way of doing it would be to configure a transparent proxy with verbose logging enabled. Another way is to configure a span port on the router.

In summary, if you can't trust the person running the network, you can't be certain that your traffic is not being intercepted, regardless of the WiFi security protocol being used.

share|improve this answer
The risk of packet sniffing can be reduced to a single room, if infrared/free-space optical communication is used. Secure facilities use this sort of thing if they use wireless at all. But then this isn't strictly pure WiFi any more. – LateralFractal Oct 5 '13 at 5:58

The short answer is yes. Anyone on the same network as you can usually view your traffic by carrying out a very basic Man in The Middle (MiTM) attack like ARP Cache Poisoning. I cover ARP Cache Poisoning in a lot of detail in one of my blogs about Session Hijacking, which is another form attack that you're susceptible to here.

Also, as pointed out by others, WEP is a terrible security protocol and I give a demonstration of how you can bypass WEP security in 3-4 minutes in another blog here.

In terms of what he can see, he can always see the sites you're visiting. If the site uses HTTPS then he can't see the data you're exchanging, but if it's HTTP then he could see everything.

You also become vulnerable to a lot of other attacks like SSL strpping, DNS spoofing, code injection and others. Your network is a trusted zone and should be restricted to only clients that you trust. Not only that but if he uses your Internet connection to conduct illegal activity you could find yourself in some hot water. I suggest you upgrade to a stronger security protocol like WPA2 and change the key to something only you know.

I've written another blog showing how WPA2 is near impossible to break if you use a proper PSK here. If your router has WPS I would also disable that for additional protection as it present a weak point in WPA2 security as detailed here.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.