2

Was typing in my password into an HTTPS website when I started to wonder if my home WiFi (whether a neighbor could have hacked into and monitoring it) is secure.

When I type in

Username123
Password123

Can the internet provider see it just like that?

6
  • 1
    Are you asking specifically if the ISP can monitor the wifi traffic using the wifi router they gave you? Or do you mean if they can monitor the data once it reaches the Internet?
    – schroeder
    Jan 3, 2021 at 21:31
  • 3
    Are you worried about your internet provider or your neighbor hacking your WiFi? These are two different things with (potentially) different answers Jan 3, 2021 at 22:01
  • Then, no, the ISP can't see the data
    – schroeder
    Jan 3, 2021 at 22:29
  • @schroeder If they can do either. Is it possible for the ISP to view my username/password anyway on an https site Jan 3, 2021 at 22:29
  • 1
    Maybe his neighbor is his iSP...
    – mti2935
    Jan 3, 2021 at 23:05

2 Answers 2

6

Was typing in my password into an HTTPS website

...

When I type in

Username123
Password123

Can the internet provider see it just like that?

Typically, no. The application-layer data you mentioned (username/password) is encrypted via Transport Layer Security (TLS) as it is passed from the application-layer to the transport layer.

In principle, only the web site to which you are sending the data can decrypt the data, because only that site has the private key associated with the public key you used to encrypt the data.

I'm putting in some caveat language like "typically" and "in principle" because there are situations where the ISP or other attacker could possible still steal this data. For example, if the ISP is performing a man-in-the-middle attack. But assuming the ISP doesn't have an signed/trusted certificate (signed certificate having a certification path leading to a one of the trusted root certification authority certificates installed on your computer) for the web site of interest your browser would (typically) alert you to the attack. And, of course, if your ISP (or other attacker) has an agent running on your local machine (or made you install their own CA certificate into your trusted CA certificate store) then all bets are off.

In principle, your ISP will only have to know the IP address of the website (network layer info) to route your data. The application-layer data (e.g., user/pass) is already encrypted via TLS at this point, so the ISP shouldn't be able to view it. However, certain other application-level data such as the domain name could still be leaked (e.g., if the certificate uses SNI) or reconstructed.

5
  • 3
    Also just to add that if the ISP made OP install a root certificate, the ISP will be able to do a MITM
    – Heng Ye
    Jan 4, 2021 at 0:43
  • @HengYe The ISP or anyone else who made OP install a root cert.
    – forest
    Jan 4, 2021 at 5:47
  • Agreed. I added two parenthetical sentences about trusted certificate authorities.
    – hft
    Jan 5, 2021 at 3:43
  • To me: "Typically, no" sounds more like: "Yes, they can if they wish so"... Or isn't? Jan 20, 2021 at 12:27
  • The third paragraph of this post is an attempt to describe what "typically, no" means.
    – hft
    Jan 20, 2021 at 17:14
2

As @hft's answer points out, no, your ISP typically cannot read HTTPS traffic. However, they can tell the length of traffic sent each way (possibly not precisely if a block cipher is used), which is sometimes enough to determine some things about the encrypted traffic. They can also see when data is sent each way - how many requests (and responses) are made (approximately) and how long between them - which can also sometimes reveal some things about what a user is doing.

To be clear, there's nothing special about your ISP here aside from having a "man in the middle" (MitM) position. Any attacker with access to the network between you and the site in quetion, even just a passive eavesdropper with no ability to modify the traffic, can do as much as I've mentioned here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .