1

If I am using an insecure wireless network that has no security protocol at all and trying to connect to my encrypted online banking website, can an attacker who is sniffing the wireless network sees my password in this case?

If my connection to the website is encrypted using SSL/TLS then how can an attacker see it?

1
  • They can't, if your traffic is encrypted with TLS. – timuzhti Oct 12 '15 at 4:49
5

If the encryption to the banks web site is encrypted end-to-end with TLS they cannot sniff the secret. But

  • The attacker could use tools like sslstrip to downgrade you to plain text. If you are not aware about you might not notice. There are ways for the bank to enforce HTTPS like with using HSTS, but it is not supported by all browsers and not all banks use it.
  • The attacker could mount a man-in-the-middle attack. If you are used to click through any warnings about bad certificates you might not notice that the connection is not connected end-to-end to the bank but that there is an attacker in between reading (and modifying) all the data.
  • The attacker could infect your computer by other means like by injecting malware into the normal unencrypted HTTP traffic, similar to how some ISP inject ads into the traffic. And once the attacker has compromised your computer no TLS will help you because the attacker can inject directly into the browser and deal with the unencrypted traffic, install keyloggers etc.

Please note that these attack vectors do not necessarily vanish if the WLAN is encrypted. The WLAN could be created by the attacker itself, maybe by using a name usually associated with trusted providers. Or the existing WLAN router could be hacked by the attacker, since common SoHo routers are often vulnerable to various attacks.

1

By default, nobody can read yours datas when you are connected to a site using TLS protocol.

But, it's possible to be the victim of a MITM attack, when the attacker mount a false AP (where you are connected), he can redirect your connection on his false web site. In this case, you must be careful of the certficate which is presented to you and the alerts that explain this certificate is not signed by a trusted CA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.