Let us say that I have a client and a server communicating using SSL.

If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?


Depends. In general, no. If the attacker launches a man-in-the-middle attack after HTTPS communication has already started, he can do nothing.

If he launches the attack beforehand, he can do various things. For convenience, let's assume that the server in question is GMail.

  • Pretend to be mail.google.com: This is a pretty transparent attack. The attacker cannot obtain a trusted signature for his SSL cert, and thus cannot pretend to be Google without throwing an error similar to this one. If the client clicks through this; well, that's the client's fault.
  • Catch you when you try HTTP: Some people enter http://www.gmail.com, which means that their browser will first try HTTP. Most HTTPS-only sites issue a 301 Moved Permanently redirect, but an attacker can stop this from happening and pretend to be HTTP-GMail (and pretend to be you in communications with the real HTTPS GMail -- individuals don't have/need SSL certs so this impersonation is easily done once your password is with the attacker). Note that the browser icon will no longer have a green padlock in such a case. However, not all mobile browsers visually distinguish between HTTP and HTTPS. Generally it is better to use bookmarks and save history on the client side, and use HSTS on the server side to protect against this.

There used to be many other HTTPS implementation vulnerabilities (they're pretty much all fixed now). There probably still are a few. But most rely on the user not noticing (or blindly clicking through) a warning.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.