3

Inspecting packets during a file transfer with an iOS application such as Google Photos. How would one know from packet inspecting if uploading a file is done securely despite being on a public network?

So far I know that a handshake occurs using the TLS protocol after that most of the data is delivered through TCP on port 443 and some Application Data through TLS. Is this normal behavior for an encrypted connection?

Furthermore, I know the data sent is mostly gibberish, but how can one be sure that all the packets are sent using a secure connection? I mean could you not send the data unencrypted on port 443 and having the data just being displayed as compressed data?

Does anyone know more about Google Photos and their encryption practices for downloading and uploading data with both photos and video? I just want to know if it is safe to use Google Photos on a public network.

Could one conclude that it is likely safe to use Google Photos, even on a public wifi? If you consider that to be the case please state why, if not please also give your opinion.

  • Welcome to Information Security Stack Exchange! I'm glad to see that you have done some research before asking; we value that here! The last part of your question is a bit off-topic. We don't do "is X safe/secure" questions, because it's not something we can objectively answer. The best we can do is objectively state that something is not secure. That said, I do believe you will get some answers that will help you assess for yourself whether you should use Google Photos or not. Good luck, and welcome on board! – S.L. Barth Aug 10 '17 at 11:35
  • 1
    Something to think: You're worried if some packets are not encrypted while being transferred. Are you not worried about what Google is doing with your files? Many people seem to confuse transfer with storage. Google has your files completely unencrypted and is actively processing them for things only they know. – user155462 Aug 10 '17 at 11:46
2

To be certain that the data is sent encrypted, you could decrypt it.

This requires you to either have access to the decryption keys, or to install a certificate and perform a Man-In-The-Middle (MITM) attack on your own device.

Let's assume that you have full control of the device from which the pictures are sent.

  • The first approach is to inspect the encryption keys while they're being used. This is not as easy as it sounds, encryption software is written to destroy keys as soon as possible. (There's probably some software for this type of inspection, but I don't have experience with this approach, so I can't say how effective it will be.)

  • The second approach is to use a packet sniffer, and allow it to install a certificate. WireShark has an option for this.
    What happens is that the client performs a key exchange with the packet sniffer, and the packet sniffer performs a key exchange with the server. The packet sniffer sits between the client and the server (hence the name "man in the middle" attack). It decrypts what the client sends, then encrypts it again for use with the server.
    Note that this is only possible because you installed a certificate and told your computer to trust it. You have effectively lowered your security a bit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.