What is the real risk in not using an SSL certificate?

Question

Note, I'm not asking whether or not I should use an SSL certificate, as I will always use one when possible. Better safe than sorry, but now I'm working on a group chat using a PHP web socket and there doesn't seem to be any way (that I was able to find) to make the web socket work with my existing SSL on the same web app so for now I'm building it without SSL and hoping to find a way to encrypt it later, but this got me thinking...

I understand that this means the data being sent back and forth between the browser and the server is not encrypted, and a hacker could hijack the session which is authenticated for the rest of my web app which is protected by SSL, but I'm trying to get a better understanding as to the actual real life danger of this. For context, my group chat is part of a web app that dog groomers use to track clients, grooms and staff.

1. What are the odds that a hacker would target my group chat (for example) or any other website not using SSL? Do hackers look for preferred targets? Or will any old site do?

2. Assuming a hacker was able to intercept my group chat and hijack a session, what would be the purpose? What would a hacker do with such power?

3. How easy is this? What other hurdles does a hacker have to overcome in order to intercept and read the data being passed between the browser and the server? And is there anything other than SSL that we, as developers, can do to mitigate such attacks?

Answer 1

Risks of not encrypted connections include ...

• Anyone one on the local network (or wifi network) could use software tools to view content going through the network. And the chat would not be private, although if a chat is public it is already not private.
• People could potentially inject information into the chat who are not logged in by spoofing the person who is logged in.
• A man in the middle could be done where the user logs into a phoney site that relays data from the user to your site. Since the user is not forced to be on a connection to what is actually your site. SSL is registered to your site which means they are connect to you.

This may not be a complete list, but they are what comes to mind.

Why and who: Being the information is about dog grooming, it would not attract anybody who is interest in money. But there are people who would like to be hackers who may try to do something just because they want to learn how. These script kids can be very ingenious but are not malicious by nature. So you would be an attractive nuisance to them, but not as attractive as a game with unencrypted data which they could use to cheat or modify the rules of the game, IE give themselves unlimited health, see where others are in the map, and teleport to their location, basically be that neo guy from the matrix in the game.

What tools do webmasters have in addition to SSL

You can use javascript to encrypt both with single key encryption or an encryption pair of public and private keys. Since the log in begins on your SSL host, you could supply the person who logs in with the encryption key ... so they would send you the encryption message from their known IP and you would send them encrypted messages to their IP with the associated key.

The old answer ... https://stackoverflow.com/a/56111213/483536

var _secretKey = "some-unique-key";
 
var simpleCrypto = new SimpleCrypto(_secretKey);



var plainText = "Hello World!";
var chiperText = simpleCrypto.encrypt(plainText);
console.log("Encryption process...");
console.log("Plain Text    : " + plainText);
console.log("Cipher Text   : " + cipherText);
var decipherText = simpleCrypto.decrypt(cipherText);
console.log("... and then decryption...");
console.log("Decipher Text : " + decipherText);
console.log("... done.");

SSL equivalent in Javascipt

The pair -- The AES Encryption algorithm (also known as the Rijndael algorithm) -- is a bit more complicated for reference I found https://www.folkstalk.com/2022/09/javascript-string-encryption-and-decryption-with-code-examples.html ... based on crypto-js found archived by google code https://code.google.com/archive/p/crypto-js/ Github https://github.com/brix/crypto-js and others.