Let's assume that I unwittingly connect to a malicious WiFi network and visit some websites. By malicious, I mean the network has been set up for the purpose of stealing data.
https:// is safe. Is this true for networks set up for malicious purposes?From what I've read, using https:// is safe. Is this true for networks set up for malicious purposes?
If done right https is still safe. But, if you (actively) accept any kind of untrusted certificate (self-signed or signed by unknown CA) an active man-in-the-middle attack is possible. If the attacker owns a public root-CA or some intermediate CA or managed to issue specific certificates it is even possible to mount such attack without needing the victim to actively accept the spoofed certificates. While this is unlikely it was actually done.
If you are connecting to a site which uses public key pinning or certificate pinning (like access to google.com from Google Chrome) you are still safe in this case, but only for accessing these specific sites.
If the attacker instead managed to steal some high value certificate or issue such certificate for sites not protected by pinning, than it is possible to do harm on other sites too, because high-value sites like google-analytics.com, jquery.com etc are often included as script into other sites.
If I visit websites where I'm already logged in, and thus don't enter any passwords, can my credentials to these websites be compromised? What about session hijacking?
For HTTPS you should be safe (see above). For plain HTTP it depends a lot on the site. Some sites not only use a random session cookie but also add browser fingerprint into it. This makes session hijacking harder but usually not impossible. Other sites instead let you change the users password or the reset e-mail without asking for the old password. In these cases a permanent takeover of the account is possible.
EDIT to summarize the good comments here: any security collapses when you use unencrypted HTTP (or FTP). From then on sslstrip, script or HTML injection etc make it possible for an attacker to hijack anything. So you better disable HTTP and FTP , which could be done by setting the relevant protocol proxy to something non-existent.
https:// is not affected by sslstrip and also following links from inside a https-site is not affected.
Commented
Jan 5, 2015 at 13:34
HTTPS is safe, if you pay attention to the browser's security indicator. There are various ways of redirecting HTTPS connection attempts to become plain HTTP, and it's possible to perform a man-in-the-middle attack with a self-signed certificate, but if you're paying attention, your browser will alert you to these.
Yes. If the connection is performed over plain HTTP, an attacker can intercept the cookies and perform a session-stealing attack. If your login credentials are stored in the cookies (something a distressing number of forums do when you click "keep me logged in"), those can also be stolen; if the website does not require you to re-enter your password to access or change your login details, a session-stealing attack can get your credentials that way.
