We all know that it is possible to spy on other people in the same wifi network, even if it is difficult.

What about apps, like Facebook app for Android? Is it similar to an https website so it is encrypted? For example, if I put my password on the Facebook app, can someone on my wifi network look at it?

  • Of course you can.. Your app is communicating with the facebook server so if you mitm the network you'll be able to capture those packets. This doesn't mean that you can see the content easily – Osakr Oct 8 '18 at 15:18
  • 1
    in that respect, you can think of an app like any website, just without the url bar. – dandavis Oct 8 '18 at 15:27
  • @Osakr the answer is not that simple - there are lots of controls that can make it impossible to mitm, for instance. – schroeder Oct 8 '18 at 15:29
  • Using your own computer as a gateway between the router and the phone, avoiding sniffing, would work I think, anyways that's why I suggested to try out, it's the only way you can be certain of something – Osakr Oct 8 '18 at 15:46

It depends on the app, of course, but most (citation needed) major apps use HTTPS.

Facebook talks about this specifically:

... virtually all traffic to www.facebook.com and 80% of traffic to m.facebook.com uses a secure connection. Our native apps for Android and iOS have long used https as well.

It is still possible that the TLS connection could be broken by MITM, but there is a process called Certificate Pinning that helps to prevent that. Fewer apps have this turned on. In the quote from Facebook above, which was in 2013, they said:

We're actively testing pinning in Facebook mobile apps and plan to use it in browsers as well.

So, is it possible that your app credentials could be sniffed from the network? Yes. But many apps use TLS and Certificate Pinning to make this unlikely. You need to investigate each app to determine what they use.

  • Thanks.I suppose that if facebook app is encrypted like a https (as the link says) the same goes for facebook messanger right? – Mark88 Oct 8 '18 at 16:26
  • 1
    Since they say "apps" we can assume so – schroeder Oct 8 '18 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.