First of all, if the form data is submitted via the POST method that data is encrypted with the public key (take a look at SSL communication pages on wiki or elsewhere for more info). The encrypted data is than sent to the server. Even if someone ware to intercept or sniff the data on the way between the client and the server, there is no way it can be decrypted without the private key (the part located only on the server).
This way, only the server can decrypt the HTTP POST data containing the username and password so therefore sniffing the content of a HTTPS encoded traffic is pointless unless you do an SSL strip attack. This way you actually don't communicate with the server through HTTPS, but rather through regular HTTP. The attacker would than encrypt the data with the public key and send it to the server so you have a "feeling" that all is ok.
As for the reason "why" someone sniffs HTTPS - SSL protected traffic in attempt to acquire the username and password, I can only think that the one who tries it has no idea how SSL really works and thinks he/she can get something out of it.
It is probably the work (attempt) of some "lamers" who have watched Wireshark tutorials on YouTube for getting username and password from unprotected websites.
I am agree with you but my friend if you will sniffing through ARP spoofing (diverting all data through your PC) you can get credentials, there are one paper also published by some researcher of stanford university with topic "Most dangerous code in the world-implementing TLS" or something like this. Plz google it. In this paper you find apart from encryption decryption other implementation loopholes of API like openSSl, GNUTLS etc is also responsible for getting plaintext data.so it is not gurantee that you are using HTTPS websites you are very much secure.
I have posted this question to make sure that is there any other vulnerabilities or not which is known by my fellowmates here in research gate.Try to find some good papers in IEEE Explore or in ACM Dl for furhter explanations.
Just to verify my comments stated above i am attaching one article read this..
http://dl.acm.org/citation.cfm?id=2523514.2523594&coll=DL&dl=ACM&CFID=308843381&CFTOKEN=47473320
Thanks Sergio...
Thats what I said...it is not gurantee that you are using HTTPS websites you are very much secure.
Today, I got to know the very interesting article which affirm my statement
http://www.washingtonpost.com/news/morning-mix/wp/2014/04/09/major-bug-called-heartbleed-exposes-data-across-the-internet/?tid=pm_national_pop
Btw, the exchanged data is NOT encrypted with publick key. Public key crypto is used to create shared symetric keys by the handshake process in the beginning.
- Badges
- Science topic