I use public proxies a lot. I was wondering, is it possible that they can modify the html and send back malicious javascript, etc?

up vote 2 down vote accepted

Yes, absolutely. This is a classic man-in-the-middle attack. All traffic (encrypted or not) runs through the server before being passed to you. It would be trivial to read (and modify) unencrypted traffic (so anything over HTTP).

HTTPS is different. As long as it's not a web based proxy, I think you'll be fine as long as you check the certificate is correct and valid for the site you're visiting. This is because to view your traffic, they would have to be able to unencrypt the traffic and then reencrypt it to you. This means they would have to present you with a certificate signed for a domain they own and not signed for say, https://Google.com.

  • So it would still work if the target website didn't have TLS/SSL? – user3893623 Aug 18 '14 at 21:43
  • Oh yes, without TLS/SSL all traffic is sent in plaintext over the network, and can be easily intercepted and read/modified. You would have absolutely no idea it has happened either. You should assume anything sent over http is readable by anyone. – Chris Murray Aug 19 '14 at 7:00

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.