Assume that we have a user that wants to connect to the server, for example with login page, when user submits the username & password goes to the server - if man in the middle reads the user & pass, can he connect to server or there are mechanisms that can prevent this?

  • 1
    updated as this is not a crypto question
    – Rory Alsop
    Mar 16, 2013 at 17:58

3 Answers 3


If you only have username+password authentication, and this login info is intercepted, you cannot realistically block the attacker from connecting. You have to look into two-factor authentication to prevent attackers from reusing login credentials etc. And even then, when the attacker has continued access to all traffic, this will not help at all.

If you don't use https, the attacker can also simply intercept all traffic, so even if you can prevent him from logging in himself, no information is actually protected.


If you're using HTTPS with a valid certificate and your application is protected from XSS then there's no reason to think that MITM will be able to see the submitted username and password.

If you're using HTTP then you can consider any login credentials for any user compromised. You should stop thinking of extra access control methods and start fixing this situation, start using HTTPS.

Have you fixed the HTTPS situation? Alright, good, now continue reading.

One area you could look at is using specious-activity detection. If the user suddenly logs in from the a different city/country, or if he starts using a different OS and/or browser. Depending on the sensitivity of the accounts, you could lockup and then send a verification code via email/SMS/physical mail.


I'd assume 'the login page' is the http protocol.

In normal cases 'the attacker' can then connect the to server. I have tried this in some networks.

A solution is to restrict a certain number of MAC addresses of the devices that can access your Network. This can be usually configured in the router configuration.

The only problem for that is that it's not very convenient for the admin of the network, because he has to add/delete the MAC addresses all the time.

  • 1
    A MITM attacker can also intercept and spoof the MAC address, so that wouldn't help in this scenario.
    – Joel L
    Mar 16, 2013 at 13:46
  • thanks for your replay, but it is true when we are in a LAN, if we assume that this http page(login page) is a website, we can not work on MAC addresses.
    – Ali
    Mar 16, 2013 at 13:51
  • I'd have to admit, that's true @JoelL
    – nixor01
    Mar 16, 2013 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .