Question about https and nntp.

RomanNose · 21 Jul 2011 at 15:33

I am just wondering, let's say that there is someone who can perform a man in the middle attack and can see your traffic, would it be possible for that person to distinguish between https traffic and nntp with SSL enabled, both on port 443?

sidethink · 21 Jul 2011 at 17:02

The NNTP traffic running over SSL would look the same as HTTP running over SSL (HTTPS). Obviously a motivated man in the middle could try and guess/deduce the contents based on where you are connecting to (e.g. are you connecting to a known news server as opposed to a known web server?).

The man in the middle can't easily open the SSL packet to see what is inside (obviously).

So it is possible to guess, given enough supporting information, that some bunch of SSL traffic might contain news traffic but proving what is in the packet is an entirely different affair.

Moley · 21 Jul 2011 at 17:06

A man the in middle will strip off the SSL and see the contents.

RomanNose · 21 Jul 2011 at 17:12

That's fine then, I am just concerned about whether I will be able to use nntp at University. Obviously I can, given a provider such as astra web that allows 443 however they will know the server is astra web and probably won't be so keen on it. In that case I have two options, tunnelling to my home network where I will Run Sabnzbd + other services or buy a VPN. I will decide later on what I will do, it all depends on the Universities policy to using Vpn's. ( If I am using a vpn on my home network then they won't know if it's a VPN or not, however using a commercial provider they can just look at the destination I am connecting to).