up vote 2 down vote favorite
1
share [g+] share [fb]

If I were to log in to - let's say - Gmail.com (which uses HTTPS by default), can my login and password be intercepted if I'm on an unencrypted wireless network?

And if I still have the login cookie from a previous session so that I don't have to reenter my login and password, can third parties get access to my account? Is there a distinction between HTTP and HTTPS here?

link|improve this question
100% accept rate
feedback

2 Answers

up vote 5 down vote accepted

As long as a man-in-the-middle attack is not in progress (unlikely), your data is secure over https. If you're ultra-paranoid, do what I do and proxy your web browser through an SSH tunnel whenever you're on a non-trusted network.

Is there a distinction between HTTP and HTTPS here?

Yes, one being encrypted via SSL and one not.

link|improve this answer
What if I'm logged in to a site, connect to an unsecured network and then visit the site over HTTP? Can third parties gain access to my account that way by obtaining my session cookies or something? – Pieter May 21 '10 at 18:13
@Pieter: If you visit the same domain using HTTP and HTTPS at the same time, the traffic over HTTP and any cookies that aren't marked as SSL-only will be visible. The unsecured Wifi is equivalent to the unsecured internet: people can see your traffic. SSL encrypts between the endpoints: the server and the browser, so if you are actually talking to the server then your traffic can reach it unmolested. – Mr. Shiny and New 安宇 May 21 '10 at 18:46
1) Wait... so if I log in to a site that doesn't support HTTPS such as ServerFault, my login data can be intercepted by any computer that is on the route between me and ServerFault's servers? 2) If I'm logged in to ServerFault (for the sake of argument, let's assume that I've registered like I would do on any site and not logged in with OpenID or anything) and I then visit the site over unsecured WiFi, can my cookies be intercepted in a way that would allow third parties to copy the cookies and take over my account? – Pieter May 21 '10 at 19:30
feedback
up vote 1 down vote

In fact, without HTTPS all sort of login forms are unprotected / unsecure. Even with WEP or WPA variants. all sort of wifi traffic encryptions are easily decryptable because they can get everything between you & the remote server without doing nothing on your pc or with any network device that you have used for infrastructure. all packets are in the air coming & going. Any hacker can save them without your information/permission. if you are so paranoid. even HTTPS is not certainly safe for your concerns.

Use your own proxy/tunnel. All hackers will filter packets by what they need. they never save whole traffic. when you type gmail on browser's address bar. it will ask for DNS information of gmail on UDP port 53. that's the trigger when the hacker starts to save the dump. to get rid of all sort of attempts you can only use your proxy. a good OS proxy (eg. proxifier for windows os) with a good proxy/socks server supports nonstandart decryptions (in this case you have to use linux remote machine with SS5 or Danted or any variants.)

(Note 2 Erika, i wrote this as a comment but it's didn't let me to send because of letter limitation)

link|improve this answer
+1 for clear explanation. Thanks to everyone who wrote in with answers and comments! – Pieter May 23 '10 at 7:16
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.