Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 14 down vote favorite
2

When data is transferred from my iPhone via 3G, is it encrypted, or is it relatively simple for a hacker to read the data that's transferred to AT&T's cell tower? What about after it reaches the tower?

share|improve this question

4 Answers

up vote 13 down vote

3G can be secure or insecure, it's really down to the particular implementation. If you are worried about your data while tethering or using a 3G iPad/iPhone then look at it this way, it's more secure than using free/unsecured WiFi hotspots/networks.

Really the answer to your question is that 3G is pretty secure, but it has its flaws.

3G is encrypted, the most common encryption algorithms have been cracked, with the right equipment somebody could intercept your information wirelessly. However, they would need some knowledge, some money and some motivation to do it. Then in addition to that, they would need your device to send unencrypted data (non https) so it could be deciphered. All in all it's pretty unlikely but certainly possible that your information could be intercepted. However, this is a risk for anyone transmitting data anywhere and is not isolated to 3G/WiFi or other mobile device communication methods.

Try a google search on 3G security and you'll find plenty of information on the flaws and security holes and how they might be exploited.

Just as an example, here are a couple of presentations:

3G Security Overview

blackhat.com powerpoint

share|improve this answer
One of the reasons I asked was because I often have the choice of using a free hotspot vs. 3G, and I want to know which one I should use if I care about security. At first I thought 3G is obviously more secure, since there are simple firefox extensions that can pick out passwords of people on the same Wi-Fi network, but how do I know that there isn't someone sitting in the middle of all 3G transmitted data and collecting it all the time? At least with Wi-Fi you need a to be within a certain (small) range and be running software that collects that kind of info. – Senseful Jan 28 '11 at 21:52
3  
If doing something like Online Banking or purchasing something with my credit card I'd tend to use 3G wherever possible. But even on a WiFi network, most websites which deal with sensitive data would use encryption such as SSL or TLS which would mean someone on that network would have a harder time trying to steal/intercept your data. I would say you are more likely to be at risk on free WiFi than 3G most of the time. – conorgriffin Jan 28 '11 at 22:00
up vote 4 down vote

If you are operating over https, it doesn't matter through what type of connection you are communicating over. All data is going to be encrypted from your browser to the server program. The only way to brake this is to the eavesdrop mediate the communication between you and the your final destination. To solve this, identity certificate were created. This certifies that you are talking to your final destination and not through some mediator. So as long as identity certificate match, you are safe. If the identity certificate does not match the browser will show you a security warning, saying that the certificate does not match, generally they will leave an option for you to go on with the communication, just in case in the operation you are doing you don't care about security.

share|improve this answer
Thanks for the info. I'm more interested in how secure non HTTPS data is over 3G, since by definition HTTPS should be secure no matter the connection. – Senseful Jan 28 '11 at 22:40
Yeah, thought so. It might be of interest for some reader. But in the free "hotspot vs. 3G" point, for me at least, you wouldn't trust there isn't end to end encryption. Security between my computer and the hotspot or cell tower, is not enough if after that the data is unencrypted. – Bernardo Kyotoku Jan 30 '11 at 13:49
up vote 2 down vote

Not in the least. Even HTTPS is secure only from non government or ISP level actors. Check EFF.org for more, but I warn you, it's damned depressing.

EDIT: The past is a country that is very hard to visit:

Schiener's treatment:

http://www.schneier.com/blog/archives/2010/09/uae_man-in-the-.html

Mozilla's discussion:

https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/OBrPLsoMAR8

The open letter in august detailing the problem from the EFF:

https://www.eff.org/deeplinks/2010/08/open-letter-verizon

It's not that they decrypt it, you see. Encryption we are all on equal footing until the quantum key or lock. But people who don't code are not stupid. SSL you can guarantee security to the server, but the certs themselves come from a chain of trust.

The phrase "I got that government gig! Homeland Security! Mary Anne's new boyfriend... F**k You!" , or similar must have been said at some point.

Amazon was not the only place after Wikileaks to have a group of sedans pull up. The FBI is screaming right now for backdoors in fact, or rather, to legitimize the backdoors they must have. Since government, or industrial actors are not 'actors' but 'people' it is not FUD to question it.

An example of FUD, would be to highlight say, the complexity of the mathematics and try to use that to prove an answer wrong, and restore faith in a system that worked in the past, while ignoring the forced trust in humans, and the successful exploit in the wild.

Make sense?

share|improve this answer
+1 for interesting insight on HTTPS – Cawas Jan 31 '11 at 13:53
1  
-1 this is FUD and just plain wrong. – Ricket Feb 27 '11 at 20:12
To go into a bit more detail (unlike this answer), HTTPS is HTTP over SSL; it uses at least 128-bit keys since the early 90s (e.g. Gmail uses a 128-bit SSL certificate). That means a key is 128 bits long; in other words, there are 2^128 possible keys (340 billion billion billion billion, or a number 39 digits long). It is proven that the only way to break this encryption is by brute force of a key. No system in the world can brute force that many combinations in a reasonable time; it would take literally an eternity with even government hardware. And EFF.org has nothing to do with this. – Ricket Feb 27 '11 at 20:19
1  
Also, part of the beauty of SSL is that a hacker can record the entire traffic stream, from before the connection even begins to after it ends, when a computer connects to a site it has never connected to before, and that hacker can not reconstruct the original data, nor see anything other than jumbled-up encrypted data. The math is such that even hearing everything going on doesn't give you any advantage. So this absolutely rules out your ISP sniffing HTTPS traffic, and again, even the government doesn't have the power to break the key, even if they filled an entire state with computers. – Ricket Feb 27 '11 at 20:22
I have edited my answer to highlight the error in your assumption: it is not just the encryption key that comprises SSL. Subverted. Ideas welcome. – chiggsy Feb 28 '11 at 21:02
show 1 more comment
up vote 1 down vote

A man-in-the-middle attack or snooping from someone sitting in the same coffee shop is far less likely over 3G. The equipment to do such is far less commonly available, and the expertise required is higher.

Neither is guaranteed to be secure from say, a government intelligence organization or other large sophisticated operation, as the 3G encryption is not of that grade. But HTTPS and SSH should protect you from the average snoop over either.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.