Search code examples
securitytcpclient-server

Defending Against Man-in-the-Middle Attacks

I'm writing a program for working with a client and a server, and it's interesting how to provide data protection. What are the man-in-the-middle attack protection strategies?

Solution

  • Just wanted to add to the last answer. If you're using HTTP as connection protocol:

    1. use HTTPS with TLS1.2
    2. use key pinning to check if the server's certificate is valid
    3. use HSTS to prevent additional future MitM Attacks (prevents HTTPS->HTTP downgrade attacks)
    4. do not offer HTTP (or automatically upgrade to HTTPS)
    5. if possible, use client-side ssl certificate validation to validate the client's identity
    6. allow for perfect forward secrecy (PFS)

    If you're using a custom protocol (not HTTPS) then:

    1. implement TLSv1.2
    2. use certificate pinning (at least server-side, if possible client-side)
    3. make sure you implement perfect forward secrecy