1

I just recently broke up with my ex boyfriend, I am not computer smart but he is, scary computer smart and can basically do anything, with lots of schooling and whatever it is he does for work...

I was staying at his place for about 3 or 4 months and would use his WIFI. We had a messy break up, and I wonder if he has all my information, like bank account numbers and all that stuff since I used his WIFI for my time being there. Most things were over HTTPS and im pretty sure the padlock was always there so I don’t think he was using SSL strip. Aside from that is there any other way that he could get my information if I’m only using HTTPS?

I see questions about if workplaces can see it, but not much if there was somebody in a non corporate setting, possibly willing to do illegal and more questionable things.

If everything checks out now and he most likely was not watching my data while I was staying there, what about now? If he was recording and monitoring everything I was doing but not able to see the exact data, is there any way that he could go back through and see it now? From what I understand is its all encypted and gibberish, but could he do anything to see my data anyways, like do ssl strip on a browsing session that ended when I left a few weeks ago, or what I understand is a downgrade attack to see all my data even on an browsing session that ended a few weeks ago, if im not currently connected to the wifi? Or do all attacks need me to be present, currently connected and in the browsing session? ( are attacks on Https or my data and whattnot only possible when it’s occuring, or can you go back and attack/ strip an old browsing session?)

Improve this question
0

2 Answers 2

Reset to default
3

No, he cannot have recorded your traffic then decrypt it later. That takes an incredible amount of power and time.

As for "downgrade attacks", those require an active connection. You manipulate the negotiation of the security between the server and the client and force a weaker level of security. That's obviously not possible when there is no connection or on recorded traffic.

Could he have been able to see your traffic while you were there? Yes, using the methods you read about in the workplace questions you mentioned. Primarily by installing a certificate on your devices so that the lock would be there, but he was logging all the details because the lock was to him and not to the site you were browsing.

Improve this answer
2
  • ok, thats good news. is it too late for him to use a downgrade attack or ssl strip, or can he only do that whille im connected to the wifi and browsing the internet, or can he do that after im allready long gone? i dont think he did anything suspicious whille we were on good terms, but its good to know whats possible. i did not see him medle with my things, i dont think he installed a certificate. I am about to use google to see if i can tell if any of my certificates have been messed with. thank you!
    – 56on34
    Jan 25, 2020 at 22:04
  • i think this clears things up for the most part, so far i think i look good, when i get to my paranoid moods i may dig google for more information but maybe i am just being paranoid. appreciate the help!
    – 56on34
    Jan 29, 2020 at 7:34
0

If your computer is clean, the recorded HTTPS traffic is useless - it is incredibly hard to crack the encryption for modern TLS.

That being said, there are many other ways he could have attacked you, like installing spyware on your devices.

Improve this answer
2
  • I appreciate all the help from you guys, my main question which i cant find a direct answer is if its possible for him to still do downgrade attacks or anything like that on any of the data that he may have recorded. so like, even though im not currently connected to his WiFi, if he could use ssl strip or any other questionable methods on any of the browsing sessions today, after i used on his WiFi a few weeks ago, or if they are only possible to perform while i'm connected and browsing?
    – 56on34
    Jan 29, 2020 at 5:15
  • 1
    Downgrade attacks are active - you can't do them on already captured data
    – rebane2001
    Jan 29, 2020 at 9:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .