19

My question is, if somebody, today, in 2024, sent a password or a credit card number to some random HTTP website just once, how likely is that password or credit card number to be found on a hacker site in the future?

Another way to ask this question is: is every HTTP packet sent on the Internet scrutinized by hackers today? If you make one mistake using a random website (and obviously it's not going to be a popular one since they would never use HTTP), will your information definitely show up on the dark web automatically?

In other words, do hacker networks have the ability to filter all Internet traffic that is sent in clear text, even if they are not targeting a specific server?

5
  • 5
    At least one nation state will probably have a copy.
    – OrangeDog
    Commented Jun 26 at 7:57
  • @OrangeDog -- I agree with that conclusion, and I think the answers mostly agree with that as well. Some nation-states e.g. Russia are setup as essentially large-scale hacker networks, willing to sell access to their data lakes for a price to criminals. Hence the correct conclusion here is: yes, your data will be accessible to criminal hackers if they really want it. In other words, if a hacker says, "I wonder if Company XYZ ever made a mistake and used HTTP when they shouldn't have" then they could learn this, gain the data, and potentially use it for crime.
    – SteveT
    Commented Jun 28 at 17:25
  • @OrangeDog -- And it's important to understand that using HTTP for one day could potentially allow a compromising breach (again, if a company is specifically targeted).
    – SteveT
    Commented Jun 28 at 17:31
  • You need physical access to infrastructure in order to capture traffic. The Russian state has access to all the infrastructure in Russia, and probably agreements with its allies. If your Internet connection never leaves e.g. Austrailia then it's highly unlikely that Russia will get a copy (but Australia, Canada, New Zealand, the UK, and the USA can all get one).
    – OrangeDog
    Commented Jun 28 at 18:05
  • @OrangeDog -- That's a good point. That changes the equation somewhat, in that unless your traffic crossed international lines (which is probably somewhat usual, for users in the US at least), your data probably won't end up for sale somewhere.
    – SteveT
    Commented Jun 29 at 19:08

4 Answers 4

31

Hackers which grab credentials from unprotected traffic are usually not "on the internet". Instead, they are typically in the same network as the victim since it is far easier to get access and sniff the information there.

"Same network" might be an open WLAN hotspot the victim just connected to, even if it has a familiar sounding name, or even if it uses exactly the same name as previously used trusted hotspots. Such rogue APs are easy to set up. Or it might be an existing but insecure hotspot, which the attacker hacked. Or it might be the victim's own network, which the attacker got access to either by someone voluntarily giving access (i.e., allowing a friend or family member to share the network) or by attacking a vulnerable router.

Most of these attacks are not difficult to set up, but this does not say anything on how likely they will occur. Some "neighborhoods" are more likely to be attacked than others—similar to non-digital crime.

3
  • What about ipv6, does it help in any way regarding "same network as the victim"
    – Tofandel
    Commented Jun 24 at 15:25
  • 16
    @Tofandel: No. IPv6 does not help here. Commented Jun 24 at 15:51
  • The question here was specifically about broader Internet traffic though.
    – SteveT
    Commented Jul 1 at 23:58
19

My question is, if somebody, today, in 2024, sent a password or a credit card number to some random HTTP website just once, how likely is that password or credit card number to be found on a hacker site in the future?

Very close to certain, but not for the reasons you think.

A hacker intercepting this one communication is fairly unlikely. There's no way to make a serious estimate in probabilities, but it's reasonably low.

However, a website that doesn't use HTTPS for things like logins is obviously not taking security seriously, which means two other things have a pretty good chance to happen, and over a long enough time almost certainly will: One, they store credentials in plain text or otherwise insecurely and two, the website itself will get hacked and the user database with the credentials leaked.


will your information definitely show up on the dark web automatically?

No. Though it'll probably show up somewhere in the "store everything we find" data lakes of the NSA and its bretheren.

5
  • 6
    I agree with the overall reasoning here, but I think "very close to certain" is too bold of a claim. It relies on too many assumptions (e.g. that a HTTP site must be insecure in other ways that allow easy leaking of plaintext-stored credentials, or that the site is even storing OP's one-time transmission at all as opposed to just using and discarding it). Commented Jun 25 at 15:28
  • @JonBentley I never assumed that the site stores the TRANSMISSION. You are right that my scenario doesn't work for credit cards if the site doesn't store them. The other scenario is a password, and the site must store that, or at least a hash of it.
    – Tom
    Commented Jun 26 at 7:37
  • @tom Yes, but I covered that with "plaintext-stored credentials", which is a separate assumption to whether it is stored at all. Commented Jun 26 at 10:12
  • I take your "plaintext-stored credentials" and one-up you to simply emailing the raw password on a reset request. Interestingly, that website did have https since hosting providers simply do it as a housekeeping favor these days
    – Layman
    Commented Jun 26 at 19:22
  • 1
    This doesn't really address the question.
    – SteveT
    Commented Jul 1 at 23:59
12

In general, entities do not have the ability to monitor Internet traffic as a whole. However, each node in the path of your network traffic is able to monitor and log it. This could include one or more ISPs that provide such data to law enforcement/governments (either voluntarily through legal means or non-voluntarily through exploitation). Whether or not they specifically look at or care about your HTTP traffic could depend on a number of factors, but it is unlikely that these are the same groups that would care to sell your sensitive data on the dark web.

As Steffen highlights, I too would be more concerned about users on the local network who can see your traffic, though the chances that someone with malicious intent is actually looking at any given moment is pretty low, especially on your own networks. I would also potentially be concerned if you were using questionable VPN providers who might themselves be malicious or allowing arbitrary 3rd parties access to your traffic (again, either voluntarily or non-voluntarily).

4
  • 5
    "entities do not have the ability to monitor Internet traffic as a whole" (quotation needed, in light of NSA revelations)
    – serv-inc
    Commented Jun 24 at 10:46
  • 1
    @serv-inc sure, but I say "in general" while largely referring to criminal groups (not so much nation states) who would be interested in the average joe's credentials or payment information. What you mention would certainly be an exception to that, and I touch on how such entities could use ISPs for such access. Commented Jun 24 at 14:56
  • @serv-inc I don't think the NSA is able to monitor all internal Chinese traffic, though they might have snuck some devices into the right places (they're 100% not going to admit it).
    – OrangeDog
    Commented Jun 26 at 7:59
  • 1
    The amount of data 'in flight' on the internet at any one time is truly staggering, and would require several large discs to store, therefore its reasonable to assume that no Three-Letter-Agency or criminal gang is going to log anything other than (loosely) defined targets.
    – MikeB
    Commented Jun 26 at 11:41
5

To answer this question, you need to wonder what using HTTPS vs HTTP is actually protecting you against.

HTTPS adds encryption-on-transit to your connections. It's based on trusting the Certificate Authority (CA) that signed the certificate presented by the server you're connecting to. Data sent through said HTTPS connection will be encrypted from client to server. HTTPS does not hide metadata (which server you're connecting to, what domain name you're visiting, whether a lot of data is sent across). HTTPS also does not tell you anything about whether the site you're visiting is safe (security issues in the coding or actual malicious intent from the site owner) or whether the client you're using is safe (malware on device).

You can still connect over HTTPS to a system that does not provide a trusted certificate, meaning its certificate is not signed by a CA your system trusts. Either the system is using a self-signed certificate or some actor has inserted itself between your client and said system (a Person/Man-in-the-Middle). In such situations, you could still ignore the warning from your browser and connect over HTTPS to the system, but you're trusting whatever system that is presenting you with the certificate to not snoop on your data.
Some Endpoint Detection and Response (EDR) tooling will do SSL stripping on your system so they can scan sites you visit.

If a system does not provide a method of connecting over HTTPS to it and only serves HTTP you won't have encryption-on-transit. You could still use this connection to send encrypted data by encrypting it on your device before transmitting it, but the recipient would need to know how to decrypt it (so you need a way to securely share that secret with them). Any system between your client and the system you're connecting to would be able to view the data transmitted between the two of you. This includes parties you'd usually (hope to) trust like your network owner, your Internet Service Provider (ISP), etc.

For a malicious actor to be able to snoop on your data, they would still need to find a way to insert themselves between your client and the server. Some example scenarios are: they setup a wireless network that mimicks a network you connect with (e.g. hotspot at coffee shop, airport, ...) and convince you to connect with it; or they break into a network you trust (like your home network) and perform ARP spoofing to convince your system to use theirs as the default gateway (pathway to the internet). Usually this requires them to be in close physical proximity to their target.
If you're dealing with nation state actors, they could have installed network sniffing devices in the datacenters of your ISP or the hosting provider of whatever site you're visiting. Think of NSA's XKEYSCORE program where they collect vast amounts of metadata and unencrypted data at key network hubs.

But, as I touched upon earlier, using HTTPS is no bullet proof method of staying secure. The system website you're visiting could still actually be malicious, they could be breached, or they could collaborate with certain services to share your data (e.g. NSA's PRISM).

TL;DR; There's no simple yes/no answer to the question whether using HTTP once poses an immediate risk. There's a lot of factors and personal risk models to take into account. If there's an option to use HTTPS, it's always safer to use HTTPS. Just be aware that while HTTPS provides encryption-on-transit, it tells you nothing about the actual security/safety of the site you're visiting.

5
  • "You can still connect over HTTP to a system that does not provide a trusted certificate ..." Is that a typo? Plain HTTP never provides encryption, as you indeed mention in the next paragraph.
    – MikeB
    Commented Jun 26 at 11:46
  • @MikeB - correct, should be HTTPS
    – BlueCacti
    Commented Jun 26 at 11:57
  • This does not address the question that was asked.
    – SteveT
    Commented Jul 2 at 0:01
  • Answering the question whether browsing over HTTP poses an immediate risk can't be done with a simple yes or no, there's a lot of extra context and risk models to take into account. The actual question even asks "how likely" but I don't see anyone responding with numbers or statistics, as it's hard to impossible to collect data on this. Basically one can only provide context and best practices so OP can decide on their own whether they want to risk it.
    – BlueCacti
    Commented Jul 3 at 8:22
  • @BlueCacti -- The answer by multithr3at3d above answers the question.
    – SteveT
    Commented Jul 3 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .