5

If I am connected in a public WiFi, is there any way to know whether I am under attack or not while browsing sites using SSL?

For example, if I visit facebook.com and the URL starts with "https://", does it mean that I am 100% secure? What methods can be used to verify this?

|improve this question
7

Yes, if you see HTTPS:// in your browser window, haven't accepted any certificate warnings and you are visiting trustworthy website like a bank, your data back and forth would remain private.

If you HTTPS session were being attacked you should get a certificate warning. This might happen a) due to a fake certificate from an attacker, or b) sometimes just due to a "captive portal" trying to proxy every https connection (still not cool).

This assuming that

  • You didn't previously accept an SSL warning.
  • The attacker doesn't have their own custom Certificate Authority root cert installed and trusted by your browser.
  • The HTTPS site isn't including any mixed-content (content from HTTP sites included by HTTPS page).
  • Your computer doesn't have other programs that are calling over the network in plain-text that can be compromise your workstation. Example, browse to a plaintext site with IE, and an attacker may insert a browser exploit into another connection to compromise your computer. (super rare for public wifi)

Personally, I do banking from coffeeshop wireless, confident that may data is protected. It is pretty similar to using banking applications on mobile phones.

|improve this answer
6

First, you can never be 100% sure about anything security, it's all on a scale.

As for SSL, that just means your traffic from the site to your browser is encrypted it does not mean that you are ever secure, it is just a tool -employed properly and it does a great job (not perfect, but great).

Now as for MiTM attacks... well... unless you are the network administrator actively monitoring network traffic, it is very difficult (and sometimes next to impossible) to detect a MiTM attack.

That being said, you could always try a few things. First, run BlackSheep. It is a detection tool for FireSheep. Or use a VPN.

Personally, I just would not connect to an open WiFi, just use your cell to to anything important(ish).

Oh and also, Facebook is not entirely SSL (their profile images for instance are still unencrypted) so you are not even fully encrypted there...

|improve this answer
  • 1
    For the most popular attacks like ettercap , sslstrip , checking for https would be enough, wouldn't it? When I made the questions I meant from attacks from script-kids not from agencies or anything really hard to do. – UnderAttack Jul 31 '14 at 21:30
  • 3
    Well once again, security is on a spectrum. SSL does help, but it is not full-proof. In fact, I'd be more concerned with something called Cross Site Scripting where an attacker could either (or both) steal your login credentials and/or SSL cert, or inject malware for you. That's a huge concern IMHO. – Matthew Peters Jul 31 '14 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.