0

I was booking a haircut online and noticed that when they made me sign up for an account, the credentials were not being encrypted (or at least that's what firefox was telling me).

It's not a huge deal because it's just an account that I use to book haircuts, but it got me wondering, how much of a security risk is this if I'm on a WPA2 encrypted wifi (and can be reasonably sure no attackers know the password)? Are there other points of attack at which the data could be seen besides sniffing the packets over wifi?

2

Your data would only be protected by WPA2 to the router. Beyond that, if it is not protected by TLS/SSL (HTTPS), your data was most likely sent in the clear. As for how much of a risk? Not much considering it is only used for haircuts. If someone had a network tap anywhere between the router and the haircut website, they could see your data in the clear.

  • So by network tap, are you talking about someone physically intercepting the cable from my router to my internet company? – Matt D Oct 15 '18 at 1:37
  • Sure, that is just one possible way. – pm1391 Oct 15 '18 at 3:02
  • What would be the other possible ways? – Matt D Oct 15 '18 at 15:26
  • Redirecting traffic could be another way. But a bigger issue here. TLS/SSL uses server certificates so you know you are talking to the haircut server and not someone else (authenticity). Without TLS, you can't be sure of that. – pm1391 Oct 15 '18 at 18:20
  • But what I'm asking is specifically how could an attacker redirect my traffic or otherwise cause me to talk to a server other than the true haircut server besides physically intercepting the wires that my cable company put up or somehow gaining my wifi password to reroute my DNS? Sorry if this is a noob question, I'm just really curious. – Matt D Oct 15 '18 at 18:58
1

The idea behind WiFi WPA2 is to secure wirelessly interconnected devices, more of WPA2 was brought into existence to offer similar security features that a wired connection does. Now, considering the HTTP protocol, this is an extended network connection which goes beyond your WiFi (local) network. When you now communicating over HTTP, you will have to ALWAYS consider your connection to be via TLS/SSL (even if You're within you WPA2 network because, just to name one, you are vulnerable to MITM attack.

WPA2 on itself in our current cyberworld isn't enough, you should always think of securing your Transport Layer connection.

  • How would a MITM (I'm assuming that stands for man in the middle) attack occur within my WPA2 network if the attacker doesn't know the wifi password? – Matt D Oct 15 '18 at 1:41
  • While we can limit our thinking within WPA2, we should also think what other services are associated in the Network Transport Layer. Your data can be intercepted by simply knowing the BSSID of your wireless network(en.wikipedia.org/wiki/Aircrack-ng) Yes, you can create a closed connection which doesn't connect to the INTERNET, in this case, you will have an internal DNS resolver, but if you're using a public DNS resolver like your ISP, anyone is capable of doing advance MITM attack. Check this out security.stackexchange.com/questions/110903/… – sec-social Oct 15 '18 at 12:04
0

Anyone who also has the password for your wireless network can intercept any data that you send across it, at least if it's a basic home consumer network with no fancy WPA1/2 enterprise features enabled.

Other than that, it's the same as having your computer directly plugged in to your ISP. Most cable ISPs have baseline privacy turned on, so that other cable customers can't see other people's data. Anyone who operates any of the big routers on the Internet between you and the other end, or people who work at the data center where the hair cut website is hosted, could tap in to the connection and find out about your hair cuts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.