Can an anonymous proxy service capture my email password?

Home » Privacy

Summary: Anonymous access or proxy services provide a level of anonymity by hiding your IP address from sites you visit. A malicious proxy can do a lot more.

•

Short answer: quite possibly.

Longer answer: quite possibly your password and much, much more.

It depends on the proxy server, how it works, and how you're connecting to the sites you're attempting to access anonymously.

•

First, a quick refresher on how you connect to a web site and why an anonymizing service is interesting.

Recall that when you connect to a web site your internet IP address is provided to the server hosting the web site:

And yes, that's Ask Leo! in the example image because as you're visiting this site, your IP address is transmitted to the site. In fact, I think your IP address is:

38.107.191.80

As we'll see in a moment, several things can affect that, but for most of you that's the internet IP address of your computer or your router if your computer is behind one.

You can't prevent an IP from being exposed to the computers and servers you visit. It's the fundamental nature of the internet. Communication of IP addresses is required to make it all work.

But you can - sort of - control which IP gets communicated and how far.

Enter the anonymization service:

Here you can see that you're using an intermediary. Your IP address only goes as far as the proxy service. They then turn around and make the web site request on your behalf (hence "proxy"), exposing only their IP address to the web site you're visiting, not your IP address.

There are several such services, but they all share one thing in common:

You have to trust them.

•

Here's the problem: every request you make, and every response you get is routed through the proxy service's servers.

Everything.

That has two exceptionally important ramifications:

1. The proxy knows your IP. If they maintain and retain access logs, it's conceivable that those logs could be demanded by legal authorities to track activity. They'd know the IP address you were coming in from and the web sites that you were visiting through the proxy.

   I'd expect a "good" proxy not to keep those logs at all, but you never know. It's a matter of trust.

2. The proxy sees your data. Every request you make goes to the proxy where it's interpreted so that the proxy knows what to do with it next. While it's looking at it, your data could be there for the proxy to examine and do whatever else with. So yes, if that data contains your email account name and password in unencrypted text, you bet a malicious proxy could be collecting that information.

Fundamentally you're implicitly trusting the proxy to be a good player - both preserving your anonymity, and not peeking at your data.

•

But what about secure connections using https?

In general, a proxied connection over https is safe from data snooping. The proxy still knows your IP, of course, so that responses can be sent back to you, but the data is obscured by encryption.

There are issues to be aware of and be careful with:

• Know what's being encrypted. Quite often only the connection to the proxy server itself is encrypted. For example, if you're connecting to https://secure.proxyserver.com?moredata then you're establishing a secure connection only to the proxy server. This is common for services that provide secure internet access for open wifi hotspot users, for example, as it prevents all your data from being sniffed.

  It's also not uncommon to configure a proxy service in your Internet Options in this same way. When this is done then the connection to the proxy server is secure even if you're not specifying https on every website access.

  But the bottom line is that if the connection to the proxy server is secure, that still does not prevent the proxy from examining your data.

• Make sure it's proxying end-to-end https connections. So the solution keep your data secure even from the proxy itself is to use secure connections end to end. For example accessing https://mail.google.com establishes a secure encrypted connection between your computer and the service. Proxies or other types of data interception will not be able to decipher the contents of your communication.

  The catch? Not all proxy services handle https. So if you make an https connection to your favorite site then you might be connecting directly, and thus exposing your IP address to the site, defeating any attempts to gain anonymous access.

• There's an obscure hack that could render https insecure through proxies. Particularly in a corporate or other institutional environment where you don't actually control your own machine, replacement security certificates could be installed on your machine that could allow the proxy server to intercept secure communications to specific https sites. Your browser would connect securely, but would be tricked into connecting to the proxy thinking it was connecting to the remote site. The proxy could then decrypt and examine your data before re-encrypting it and sending it on to the site you're accessing.

  The only way I know of to detect this is to examine the security certificates of the https connection at the time you make it, and make sure that the entire chain of certificate trust is as it should be. Yep, this can be obscure and/or difficult, particularly since we don't always know what it "should be". Comparing the certificates you see at work against what you see at home for the same connection might be a good indicator. The good news, if you want to call it that, is that this is also difficult to set up correctly in the first place, so I believe it's quite rare.

As you can see, it really does all boil down to trust. Just like your ISP for normal connections, you're giving a proxy service a tremendous amount of access just by using them. Your IP address might not be presented to the remote site you're connecting to, but just by the nature of the internet it must be presented to the proxy. And in the worst case not only can a proxy log your accesses, a malicious proxy could typically quite easily examine your data, passwords and all.

Related:

• Ask Leo! - What's a Proxy Server?

• Ask Leo! - Getting all worked up over IP tracing

• Ask Leo! - When I visit a web site, can the server identify me?

• Ask Leo! - Can my ISP monitor my internet usage?

Article C3206 - November 8, 2007