I use public proxies a lot. I was wondering, is it possible that they can modify the html and send back malicious javascript, etc?


1 Answer 1


Yes, absolutely. This is a classic man-in-the-middle attack. All traffic (encrypted or not) runs through the server before being passed to you. It would be trivial to read (and modify) unencrypted traffic (so anything over HTTP).

HTTPS is different. As long as it's not a web based proxy, I think you'll be fine as long as you check the certificate is correct and valid for the site you're visiting. This is because to view your traffic, they would have to be able to unencrypt the traffic and then reencrypt it to you. This means they would have to present you with a certificate signed for a domain they own and not signed for say, https://Google.com.

  • So it would still work if the target website didn't have TLS/SSL? Aug 18, 2014 at 21:43
  • Oh yes, without TLS/SSL all traffic is sent in plaintext over the network, and can be easily intercepted and read/modified. You would have absolutely no idea it has happened either. You should assume anything sent over http is readable by anyone. Aug 19, 2014 at 7:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .