Suppose that I login to a website. When I type my personal data, aka, password and email, the password is sent in clear text to the server, correct? Then, a network card in promiscuous mode can capture the password?
How this can be avoided?
https is designed to prevent this kind of attack: The communication between you and the server is encrypted. The server will provide a certificate to ensure that it is the correct one and not a man in the middle.. If the certificate is signed by an certification authority trusted by your browser, the connection will be accepted automatically. Otherwise you will get a warning about an untrusted certificate. If you are in doubt, don't click it away.
There is really no excuse not to use https for login, as simple trusted certificates are really cheap or free of charge. https should be used for everything, but some huge sites argue that it uses too much processing power.
|show 8 more comments|