Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Depends. In general, no. If the attacker launches a man-in-the-middle attack after HTTPS communication has already started, he can do nothing.
If he launches the attack beforehand, he can do various things. For convenience, let's assume that the server in question is GMail.
http://www.gmail.com, which means that their browser will first try HTTP. Most HTTPS-only sites issue a
301 Moved Permanentlyredirect, but an attacker can stop this from happening and pretend to be HTTP-GMail (and pretend to be you in communications with the real HTTPS GMail -- individuals don't have/need SSL certs so this impersonation is easily done once your password is with the attacker). Note that the browser icon will no longer have a green padlock in such a case. However, not all mobile browsers visually distinguish between HTTP and HTTPS. Generally it is better to use bookmarks and save history on the client side, and use HSTS on the server side to protect against this.
There used to be many other HTTPS implementation vulnerabilities (they're pretty much all fixed now). There probably still are a few. But most rely on the user not noticing (or blindly clicking through) a warning.