Suppose I have a website such as www.myforum.mysite.com, can an attacker sit down and listen to or scan my forum and get everyones username and password when they try to log in to my forum or site?

Is SSL necessary to avoid such a thing or is there no need for this? I was thinking the attacker can't do anything about it since users and hacker are not in the same network (e.g cafe net wireless network) ? Thanks in advance


They can't snoop your traffic unless they are in a position of adjacency to any system in the routing chain.

When a client first connects to a server, the packet will go from their computer to their router, which then passes it on to the ISP's local routing server, which then passes it down a backbone (via a set of other large routers) and eventually to the server's ISP's local router, through the data center's network infrastructure, and eventually to the actual server. In total there may be as many as 40+ routers involved, if you're routing across the globe. If any single one of these is compromised, an attacker could sniff traffic.

However, your primary risk scenarios are:

  1. User's computer is compromised.
  2. User's network is compromised.
  3. Server's network is compromised.
  4. Server is compromised.

In scenario #1, you can't do anything to prevent the issue. Their system is compromised and their credentials can be stolen. You can help mitigate the issue by asking for 3 characters of a secret word each time they log in, but decent malware would just steal the session ID or something similar.

In scenario #2, an attacker can put their network adapter in promiscuous mode, which allows them to sniff the traffic on the network. If you don't use SSL, this traffic can be read, tampered with, etc. Protecting users from this scenario is the primary reason for using SSL.

In scenario #3, a similar issue occurs, but it's on the server network. The requirements for a successful attack here are largely based on network layout and configuration, since the position of the compromised system on the network is critical in terms of whether the attack will be successful. A switch between their system and yours could prevent promiscuous sniffing. It's pretty hard to know whether or not this kind of attack is happening (it's not your network, it's the hosting company's) so SSL is a good protection here.

In scenario #4, you're screwed again. Your server is compromised and no amount of transport security will save you.

There's a 5th scenario, whereby an ISP or backbone provider (e.g. Level3) are actively logging and sniffing traffic on their network. If you care about this, SSL can help. If you're worried about state actors (e.g. the NSA, with PRISM), then SSL isn't really going to help you, as they can use warrants to get hold of the server's private key and decrypt all of the traffic.

  • Is there a scenario 6 where the web app is poorly designed or implemented and there's no access control around resources that would return user details? – u2702 Jun 21 '13 at 15:58
  • Sure, but that's outside of the scope. OP is asking about traffic sniffing of usernames / passwords from logins. – Polynomial Jun 21 '13 at 16:06
  • @Polynomial:Thank you very much ;) I appreciate your help and well explained answer :) – Rika Jun 22 '13 at 5:32

The most obvious case is this one: Your user is using his mobile phone (or a Laptop) in Starbucks or any other public WiFi to log in to your site. Anyone else in the same public WiFi network can listen to your user connecting with your website and sniff the traffic and therefore capture the login credentials. If you're not a popular site, probably nobody will care to steal these worthless logins. If your site is Facebook or even just a popular forum, people will care and sell these logins. There are many public places where all the traffic is captured all the time, automatically scanned for logins and found login credentials sold on underground forums. So yes, if you have a public site that uses logins, use SSL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.