Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've heard that not using https is dangerous because of man-in-the-middle attacks.

Now, if I connect to a server from my home computer, I assume traffic passes through my ISP, so they could eavesdrop if they are malicious.

But how can a random IP address "order" my traffic to go through their IP so they can scan it, as well?

Do hackers have the power to just start snooping on traffic between any 2 random IP addresses if they wish to?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Government agencies can do so (if they really want to) by using a subpoena on any of the intermediary providers or on any of the end nodes. A "random" IP "somewhere on the internet" cannot just listen in on your traffic. If it can not re-route traffic past himself then there is no chance of eaves dropping onto the connection.

Anyone who has access to your transfer medium can theoretically snoop on your connection. This can be someone who's also connected to the same wireless AP as you or any of the ISPs between you and your end point.

share|improve this answer
1  
What about the modification of Border Gateway Protocol routes? There was an article by Ars Technica recently on how this was done multiple times by unknown entities... –  Nasrus Nov 26 '13 at 13:53
1  
BGP routes are also an option, but most of the "unknown entities" are also government agencies. BGP is not really easy to just play around with... –  Lucas Kauffman Nov 26 '13 at 13:58
    
Just for reference, it's this article: arstechnica.com/security/2013/11/…. Also, I'm thinking that maybe it's possible that a malicious hacker hacks an ISP and changes routes from there. –  Nasrus Nov 26 '13 at 14:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.