Sensitive data in public wifi networks with https

Question

Everybody knows that we should not enter our bank data, credit cards numbers being connected to the public wifi network.

Let's imagine that somebody goes to his bank's web site being in public network. Yes, his traffic can be captured but using https it's encrypted by banks public certificate. So none exept bank can decrypt this personal data.

All of this is in case when user is really sure that it's a public hotspot of the airport, not some hacker's one.

I'm wondering it it really so or it's not so easy?

Answer 1

This depends on the website and wether it enforces https with the right TLS version and correctly so (And has been visited before or is in the users HSTS preload list).

If not, a man in the middle could use a so called “downgrade attack” and not only read the traffic but manipulate it.

The thing with unencrypted public WiFi is, that a man in the middle position becomes feasible for everyone in close proximity, even relatively easily.

With such a position, many attacks that otherwise wouldn’t be possible become viable.