0

I've searched for it but couldn't find a direct answer to this relatively simple question. Most questions are about a 3rd party intersepting the HTTPS POST or GET parameters inbetween client and server.

But my question is: can a PC user somehow see the HTTPS POST or GET parameters?

My C++ application sends HTTPS POST and GET requests to a third party website. In these requests it sends a secret password, which shouldn't be known by anyone except my application and the website. So can user use some kind of software, like firewall app etc. and see this secret password?

Improve this question
5
  • This question has nothing to do with information security.
    – mentallurg
    Commented Mar 25, 2021 at 19:45
  • Depending on how the private key is generated/stored, the user don't even need to inspect the traffic to get it.
    – ThoriumBR
    Commented Mar 25, 2021 at 20:59
  • It's not generated or stored, it's hardcoded in code. Third party website uses it to determine which app is sending data to it.
    – Dmitriy
    Commented Mar 26, 2021 at 18:38
  • HTTPS almost certainly protects you from man-in-the-middle attacks and most hackers don't try to fight cryptography itself anyway because they are almost certainly beaten. There is always a threat of leaks from memory or malware etc at the ends as others have already mentioned. Not about what you asked but why do you need to send your private key anyway? Private keys are never meant to be shared, they should stay safely where they were generated. And whatever you can do with shared private key, you can do without sharing it. So I would advise you to reconsider your design.
    – Manish Adhikari
    Commented Apr 4, 2021 at 7:12
  • Ok, I edited question, replaced "private key" with "secret password" to not confuse readers. It's not a cryptographic private key.
    – Dmitriy
    Commented Apr 4, 2021 at 20:40

3 Answers 3

Reset to default
4

HTTPS protects against man in the middle attackes. Machines between the client and the server can not see HTTP GET or POST parameters.

However, other applications on the client (e.g. a TLS intercepting proxy) could potentially read the entire request, parameters included, in clear text. Or an application with sufficient priveliges could read the secret key from memory. So whoever controls the client - your users, or malware on their machine - will be able to read the secret key.

Improve this answer
4

Yes. The user could decompile your program, add some code that writes the parameters into a file, then compile it again and run it.

Improve this answer
1

My C++ application sends HTTPS POST and GET requests to a third party website. In these requests it sends a private key, which shouldn't be known by anyone except my application and the website. So can user use some kind of software, like firewall app etc. and see this private key?

Yes.

Stealing the data out of HTTP and HTTPS GET/POST requests from a native app has been a common threat for a long time.

For example, if can be accomplished by malware running on the local machine that injects into the target process.

As mentioned in the other answer, it would also be possible to statically analyze your app and grab the sensitive data. But, it can also be done dynamically by injecting malware like I mentioned above.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .