When you talk to your friend on the phone or

meet up with a coworker, you can recognize their voice or face.

But computers aren't that smart.

To them, it's just ones and zeros coming and going.

And this lack of distinction can be exploited.

Someone else can pretend to be Gmail, for example, and trick you and

your computer into thinking you're just logging into your email.

They can even claim to be you to your contacts.

This video explores the general concept of this interception and

impersonation, called man-in-the-middle, and ways to prevent it.

Let's return to our illustration of common Internet traffic inside the coffee shop.

You're on your laptop,

connected to the open WiFi network with other people in the coffee shop as well.

One of those people could be malicious and take control of the coffee shop router.

[SOUND] Maybe the device is shipped with a default admin password that was never

changed.

It happens more often than you might think.

I'm simplifying a bit here, but this malicious user can send a message to

the router to say that their computer's IP address is actually the address for

a given website, http://LocalBank.com, for example.

Now all requests for http://LocalBank.com from that coffee shop will

go to that computer instead, including passwords or other secret information.

Sometimes this can be very difficult to detect.

That malicious user can pass on the traffic to the intended destination,

as well as pass back a response without anyone noticing a difference,

essentially just passively observing.

This is dangerous enough, as now they have your login credentials and

can access your account any time.

But let's you try to set up two factor auth for your account.

Your bank verifies it's you with some security questions that the attacker now

knows, and then you give them your phone number for them to text the code.

The malicious user can substitute their own phone number,

receive the texted code and enter it themselves, and then text you the code.

When you attempt to enter the code,

they already have the bank's response ready for you.

This is no longer just passive eavesdropping, now it's active deception.

The man-in-the-middle attack can take many different forms.

The key point here relates back to one of our first videos,

it's all about authenticity.

You want to be certain that the person you are talking to or

the website you are visiting is who they say they are.

How the Internet enforces this concept is usually through HTTPS.

HTTPS is a secure version of HTTP, or Hypertext Transfer Protocol.

These two protocols make up a large portion of how our Internet traffic works.

You can often see a green lock in your browser's address bar for

sites that support HTTPS, like Google or Facebook.

You should consider HTTPS a must for any activity that involves sensitive

information, like purchases or bank logins.

For this last example, if your bank's website is usually https://LocalBank.com,

but for some reason you could only get to http://LocalBank.com at the coffee shop,

then that could be a hint of a man-in-the-middle attack.

Certain browser plugins and tools like HTTPS Everywhere

can force your browser to serve the more secure versions of sites when available.

Another problem with that previous scenario is that you were stuck

with an open WiFi network.

The best solution would be to convince the coffee shop

to add a strong password to their network.

But even networks with shared pass phrases are not completely secure.

The next best option would be to use a VPN, or virtual private network.

These are networks that can be set up anywhere,

you can even do it yourself at home.

You would then route all traffic through this network, which you either control or

have considerably more trust in.

It then works very similar to HTTPS, where your traffic is encrypted and

private from eavesdropping.

VPNs can be a bit of an advanced topic, so we won't cover them

any more than to recommend them after some additional research.

Man-in-the-middle attacks are also a bit advanced, but

prevention is relatively simple, and the important takeaway is to consider it well

worth the effort to verify the authenticity of your traffic.