I want to secure site which is locally used for Prepaid Services, the site has been hacked many times, for the first step, I implemented SSL and its now working fine, however, I want to be sure that attacker can't get user data in transit because many users connecting to the site from restaurants or public places.

One scenario: Using BackTrack attacker can redirect all HTTP traffic to single IP and show fake page to user, I knew browser shows SSL error, the best way to prevent this attack is to educate user, however, I want to ensure that there is no other way that attacker can attack the site anymore.

Update: I planned also to implement PIN verification (Sending random PIN by SMS for extra verification)


SSL/TLS only protects against data inflight, implementing it won't change the attacker's ability to directly attack the site. TLS will protect against an attacker being able to see the data (confidentiality) and modify the data (integrity). However, as you've discovered, it's possible for an attacker to actively MITM and present an invalid cert to the end user, and if the end user accepts it, then all bets are off. HTTP Strict Transport Security (HSTS) can help prevent this by requiring that all future visits go over HTTPS, and may (depends on the browser) change the behavior of the browser when receiving an invalid certificate. Chrome, for example, will not present a "continue anyway" button for a certificate error against an HSTS site.

All that being said, active attacks against SSL/TLS are relatively rare (sorry, no numbers to back that up at hand) and are hard to conduct on large scales (as they are usually close to the end user, so only get a small number of users). Phishing, typo squatting, or other similar mechanisms are far more likely to cause you problems.

If you want to make password capture (whether via SSL/TLS stripping or interception, phishing, or otherwise) less valuable, implement strong two-factor authentication, such as HOTP or TOTP.

  • HTTP Strict Transport can be avoided when MITM. so, by adding PIN verification such as in Facebook, we can prevent all possible attacks :) I hope that
    – Akam
    Jul 17 '13 at 6:12
  • 2
    HSTS can only be stripped by MITM if the first connection is MITM. PIN verification can also be MITM, don't see how that would help.
    – David
    Jul 17 '13 at 6:47
  • Thanks I get this point. About PIN being MITM: but how attacker knows the mobile number of the client? for example: the technique used by FB... that's how it protect user
    – Akam
    Jul 17 '13 at 6:48

SSL does what you are looking for. It will protect connections against both passive and active attacks, provided that the user does not click through browser warnings. If the user does not heed such warnings, then he is doomed, regardless of what you do. If the user connects with no warning, then SSL will protect data in transit. Moreover, there is just about nothing more that you can do: if SSL does not protect you, then anything you send to the user (e.g. Javascript code) could be altered by the attacker; so that's SSL, or nothing will do. Fortunately, SSL is robust enough.

Note, though, that most attacks are not about SSL, but rather exploiting holes in your site implementation. There is no need to try to crack SSL upfront if a simple SQL injection attack can reveal a complete dump of your site database.

  • Thanks, what about PIN verification by SMS? similar to faecbook that sends random PIN, I think it tells user to leave the site when they not received the PIN
    – Akam
    Jul 17 '13 at 6:09
  • If an attacker controls the page that displays the "warning about PIN not being received", then you can assume the user won't get that page. So in this scenario it does not add extra security.
    – domen
    Jul 17 '13 at 9:15
  • 1
    Indeed. PIN verification is for the server, to make sure that it talks to the right client; it does not give any assurance that the client is talking to the right server (TLS-SRP would do that, though, but usual browsers don't support it yet). Jul 17 '13 at 12:11
  • @domen BUT Verification PIN by SMS is the latest technique that used also by facebook, if user didn't get SMS when he entered user and pass then it means that the page is fake
    – Akam
    Jul 17 '13 at 12:55
  • 1
    Just a precision: if you implement X509 client authentication in at the SSL layer, then you can protect your user even if he clicks through the warning since your server will be the one rejecting the authentication from the MITM proxy. That won't do anything about man-in-the-browser attacks since it operate after the endpoint encryption, but still.
    – Stephane
    Jul 17 '13 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.