PPRuNe Forums - View Single Post - Hiding your IP address for privacy
View Single Post
Old 28th August 2008 | 22:28
  #21 (permalink)  
Saab Dastard
Administrator
 
Joined: Mar 2001
: PPL
Posts: 8,121
Likes: 686
From: Twickenham, home of rugby
Mixture, to clarify (for the benefit and partial reassurance of others):

Communicating over an usecured wifi LAN does not mean that SSL traffic (HTTPS) is unencrypted, but there is the possibility of a MITM attack, even against SSL.

The MITM attack requires the ability to observe and capture traffic on the network as a preliminary to the attack, the observation of itself is not a MITM attack.

It is indeed dangerous, and this is why SSL connections to corporate VPNs or online banking (for example) have moved to two-factor and / or mutual authentication to defeat the MITM vulnerability.

In this case, the MITM cannot supply the correct certificate or password and cannot spoof the connections.

But all unencrypted traffic is visible on an unsecured LAN, and access to the PC itself also becomes possible, both from the local LAN and potentially from the internet as well.

SD
Saab Dastard is offline  
Reply