1

If anyone can answer me pls I just need an anwer. I know thus isn't maybe right place for this question

I created chatting app with sockets in Java 8 and i use TLS 1.2 My question is: Is there any way that someone can read data i send(read as he can decrypt it)? Maybe something like man in the middle attack or something else.. I should note that the server which i use is just for sending incoming messages to destination clients (not storing anything on it).

I ask this because i was always wondering how come the people who use so called protected apps get caught at the end.What if someone uses my app and start sending some illegal stuff(literally anything). Could this person get caught if there isn't any data storing on my server and am i allowed to claim that my app is definitely secured?

Sorry if it's stupid question

6
  • 1
    Since this is exactly the same question you've asked at Unix & Linux you get exactly the same answer from me. Dec 18, 2022 at 14:37
  • I understood you. It all made sense to me just want to hear if other people have anything more to add from other community
    – GM dz0ji
    Dec 18, 2022 at 14:45
  • OP, I don't think @SteffenUllrich could have made his answer any clearer [+1]. His third point is especially important. The client must have a way of authenticating the server's certificate - otherwise a bad actor between the client and the server who is able to dupe the client into trusting a fake certificate can mount a MITM attack.
    – mti2935
    Dec 18, 2022 at 14:50
  • So in other words with MITM someone can read everything I send to someone in my secure channel?
    – GM dz0ji
    Dec 18, 2022 at 14:59
  • 1
    That makes sense. Thank you for detailed explanation. And thank you guys a lot. Sorry if I wasted your time you helped me so much! 😄
    – GM dz0ji
    Dec 18, 2022 at 15:31

1 Answer 1

1

TLS protects the communication between client and server if properly implemented. This means

  • it does not protect against compromising the server or client
  • it does not protect against bugs in the application, like XSS, CSRF or similar in web application
  • it does not protect against MITM attacks unless the client actually enforces that it gets the expected certificate from the server
  • if one of the endpoints of the communication is compromised, then the clear text communication might be intercepted before encryption or after decryption

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .