4

I recently forgot to turn off proxy and connect through a premium account, will the owner of proxy server be able to use the cookies and access the account?

2
  • 1
    Was the connection over HTTPS or HTTP?
    – Anders
    Jun 7 '16 at 21:44
  • only login page was https
    – kang21
    Jun 7 '16 at 23:01
2

Yes.

As mentionned by u2702, anything sent over HTTP via the proxy can be clearly read by the owner of the proxy.

In your particular case, since the login page (ONLY) was over HTTPS (and I suppose that by that, you mean that the other pages were over HTTP after the login), your password could not be compromised. However, any subsequent request on their site via HTTP would bear your session cookie with it. The proxy owner could easily impersonate you thanks to that cookie, as long as the session bound to that particular cookie is valid.

If you want to prevent future reuse of that session, you can simply logout from the website (via the proxy or not, does not matter), which will invalidate the session if the site is working properly. Ofcourse it could be "too late", if malicious manipulations have already been done via your compromised account.

4

Anything that went over HTTP through a proxy was available to proxy controller.

HTTPS you should be okay, depending on the CAs that your browser trusts and assuming that you didn't click "yes" on trusting an untrusted certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.