1

Recently started turning my phone on airplane mode and it got me curious. Airplane mode is supposed to turn off all radio signals. So, I won’t be able to receive or send messages (emails aswell, and so on). Once airplane mode is turned off, I can send messages again and I receive all messages I would have gotten otherwise.

The way several messaging apps work is the message I send is encrypted when sent to the server, then decrypted, and then sent to the intended client in a decrypted state. MITM attack should be able to happen when the message is sent unencrypted to the intended client. But if I am in airplane mode (I do not receive the message), can the message still be intercepted with such an attack?

Thinking that if I was using public wifi in a store or something, then I could have my device on airplane mode so no messages are received on my end. Till I get home on my own network and turn airplane mode off. Receiving those messages when it is now a secure location.

1
  • 3
    I'm confused about how you are thinking this all works. If you are "using public wifi" and turn on airplane mode, then you are no longer using the wifi network. Therefore there is no traffic to intercept.
    – schroeder
    Sep 20, 2022 at 5:45

1 Answer 1

9

The way several messaging apps work is the message I send is encrypted when sent to the server, then decrypted, and then sent to the intended client in a decrypted state.

I am unaware of any instant messaging service that works as you describe.

Instant messaging apps will usually work in one of three ways: end to end encrypted, TLS encrypted, or completely unencrypted.

End to end encryption is when the sender's device encrypts the message and the recipient's device decrypts it. MITM should be very hard to achieve in this case.

TLS encryption is when your device encrypts the message, and the server decrypts it. However, the server will typically re-encrypt it before sending it to the recipient's device. Thus the only place where MITM is usually possible is on the server itself. And if someone with access to the server chooses to snoop on your messages, your wi-fi being secure will not help.

If, however, your messaging application is completely unencrypted, not connecting to a public wi-fi may help to some extent. Since your device will not connect to the server and download new messages, any random hacker snooping on the network will not see any of your messages. For a more determined attacker though, MITM may still be possible even if you only use a secure wi-fi.

Note that turning on airplane mode is not really helpful. Not connecting to a public network is more important. If you turn on airplane mode, then manually turn wi-fi on again and connect to an insecure public network, you will still be vulnerable to MITM by random snooping attackers. And if you don't turn on airplane mode and just use your data connection, you will be more or less as secure as on a secure, private network.

5
  • 2
    "just use your data connection" - depending on the mobile protocol used, this might add less security than you think. A lot of older cellular data protocols used weak authentication or encryption, and have been cracked. People also might be able to intercept traffic between the "tower" - possibly a compromised microcell or similar, or just an actual tower using unsecured microwave transmissions - and the carrier/ISP. Still, it's certainly less trivial than using public or unsecured/poorly-secured WiFi. Depending on the network and physical access control, wired might not be secure either.
    – CBHacking
    Sep 20, 2022 at 5:50
  • 1
    @CBHacking Good points. I wasn't aware older cellular protocols were still in use. I intended my last sentence to mean that it wouldn't be within the realm of random script-kiddies anymore, which is pretty much all the protection one should expect when communicating in plaintext over a "secure" wi-fi.
    – nobody
    Sep 20, 2022 at 14:08
  • The USA hasn't even finished getting rid of 3G, much less 2G (which is longer range and less-used, so it takes fewer towers and bandwidth allocation to support). Many poorer countries have only recently begun rolling out LTE, and will have 3G and maybe 2G for years to come. But yes, it's good to consider the threat model when talking about unsecured protocols, and whether the last-mile network security is really the biggest threat.
    – CBHacking
    Sep 21, 2022 at 8:13
  • So, a messaging application that uses TLS like insta or discord would involve the message being sent encrypted from my device, then decrypted by the server, and then encrypted again when sent to the recipient?
    – Dan
    Sep 22, 2022 at 20:03
  • @Dan Yes, that is how it would work.
    – nobody
    Sep 24, 2022 at 5:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .