Man-in-the-Middle Attacks

What it is

A man-in-the-middle attack, also called an on-path attack, places an adversary between communicating parties so they can observe, relay, or modify traffic. Being on the network path does not automatically reveal properly encrypted content. Correctly validated TLS protects both confidentiality and server identity, making certificate checks a crucial boundary.

How it works

A rogue hotspot, local address manipulation, compromised router, or routing interference can redirect traffic through the attacker. Plaintext protocols expose content directly. For protected connections, the attacker needs another weakness, such as a trusted malicious certificate, endpoint compromise, or a user accepting a certificate error.

How people get tricked

A convincing hotspot or an instruction to install a certificate makes dangerous trust changes feel necessary. Developers may disable certificate validation to fix a connection problem, removing the identity guarantee encryption should provide.

Example scenario

A hotspot presents a certificate error for a banking site and asks you to continue anyway. Refusing preserves the intended TLS boundary; the attacker's network position alone should not make that bank's encrypted session readable.

Warning signs

• Certificate warnings or unexpected certificate-installation requests.
• Network or proxy settings change unexpectedly.
• Unencrypted services carry sensitive information.

If it happens to you

Disconnect the suspicious path and inspect proxy, certificate, and device changes. Determine whether plaintext data or overridden encryption checks exposed information. Rotate affected credentials and restore proper validation before reconnecting; avoid treating mere use of public Wi-Fi as proof of interception.