Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

If I'm on an open wireless network, can a 3rd party capture packets and see all the internet traffic to and from my computer? What if WPA encryption is used, but someone has the key already? If I use HTTPS, can someone with direct access to the router decrypt the traffic and view it somehow?

share|improve this question

migrated from stackoverflow.com Sep 28 '09 at 5:56

This question came from our site for professional and enthusiast programmers.

    
Belongs to ServerFault/SuperUser. –  LiraNuna Sep 28 '09 at 5:55

4 Answers 4

up vote 8 down vote accepted

If I'm on an open wireless network, can a 3rd party capture packets and see all the internet traffic to and from my computer?

Yes

What if WPA encryption is used, but someone has the key already?

Same as if the network was un-encrypted

If I use HTTPS, can someone with direct access to the router decrypt the traffic and view it somehow?

Unlikely. They would need to have both the Private Key and the Public Key for your HTTPS host, which is unlikely. The other possibility is what's called a "man in the middle" attack, where they replace the certificates with ones that they know, so that it appears to be encrypted, but the man-in-the-middle does a translation on your HTTPS traffic so that it can read it.

Short answer: If you're on a wifi network, don't do anything you don't want to be made public.

share|improve this answer
    
MitM attack, just what I was thinking =) –  Qwerty Sep 28 '09 at 6:59
    
You can't do a MitM attack on a really secure SSL connection (with a trusted certificate chain and all). If the certificates are replaced the browser will inform the user that they can't be trusted. –  e-t172 Sep 28 '09 at 11:02
    
Unless you're on a AD that has its own CA and you issue a certificate for that website that comes from your own internal trusted CA. I bet most people wouldn't even notice that the EV is missing from banking websites. –  Mark Henderson Sep 28 '09 at 21:13
    
Arp poisoning is such a trivial thing to accomplish, that most people should be VERY afraid of using wireless for anything besides basic web surfing. –  GregD Sep 28 '09 at 22:04
    
Keep in mind there is a difference between the key used for encryption (PTK) and the pass-phrase (PMK) people think of as "the key". If you know the PTK (PMK + session specific data), you can decrypt packets, but the PMK alone is not enough to decrypt. That said, it is easy enough to get the session specific data by capturing the 4-way handshake. –  ctuffli Sep 29 '09 at 19:16

If someone is on the same wireless network as you or you are on an open network they can see your raw traffic. Now if that traffic is encrypted, for example with HTTPS, then they can only see the encrypted traffic. As far as I know there is no easy way to decrypt HTTPS traffic.

share|improve this answer

HTTPS is between your browser and the webserver, so that traffic is encrypted, though someone can capture the packets and try to break the encryption.

Given enough motive, just about any wifi encryption can be broken. You can see the traffic using some freely available tools as it is broadcast out, but someone would need to separate out what is meant for you and someone else. The wifi adapter can determine that, so programs exist to determine that.

How secure your wifi is is based on how strong and secure your key is and the encryption algorithm.

Here is an article about wifi security, and you can google and get more info on various encryption algorithms, such as WPA, and see how secure they are.

http://pogue.blogs.nytimes.com/2007/01/04/04pogue-email/

share|improve this answer
    
"Given enough motive, just about any wifi encryption can be broken." No, that is not true. For WPA2 with a strong passphrase, there is no known attack, not even a theoretical one. However, note that (using only lowercase characters & digits), a full-strength passphrase (256 bit) would need about 50 characters. –  sleske Oct 22 '09 at 9:41

To sniff the actual traffic traversing a wireless network requires a wireless adapter and driver that support RF monitor mode, which few adapters in the retail market do. Adapters of these type are usually found in the wireless testing and engineering industries and are usually cost prohibitive for the average user.

While it's true that a determined hacker will eventually circumvent just about any security mechanism, I wouldn't count on the average Joe being able to do this. That being said, I don't recommend using publicly available open wireless networks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.