What is a man-in-the-middle attack?

A man-in-the-middle attack is exactly what it sounds like: someone secretly positions themselves between you and whatever you’re connecting to, so your traffic passes through them. Done well, you never notice. It’s one of the classic reasons security people are twitchy about untrusted networks — so let’s unpack it.

How it works

Normally your device talks directly to a website. In a man-in-the-middle attack, an intruder inserts themselves in the path — often by controlling or spoofing the network you’re on — so everything you send passes through their hands first. If that traffic isn’t encrypted, they can read it, and in some cases alter it, before passing it along. Passwords, messages, card numbers — all exposed if they’re travelling in the clear.

Where it happens

The prime setting is a network you don’t control, especially public Wi-Fi. A classic trick is the “evil twin” — a rogue hotspot named to look like the café’s or hotel’s, so your device joins the attacker’s network without you realising. We cover the setting in staying safe on public Wi-Fi.

How encryption defeats it

The defence is encryption, which turns your traffic into something an interceptor can’t read even if they capture it. HTTPS does this for individual websites — always look for it. A VPN goes further, wrapping everything your device sends in one encrypted tunnel, so even on a hostile network a man in the middle sees only scrambled data to a single server. That’s why turning a VPN on before you join unknown Wi-Fi is such effective protection.

The takeaway

You can’t always tell a network is safe, so don’t rely on it being safe. Encrypt by default — keep HTTPS-only browsing on, and use a VPN on any network you don’t control. Do that and the man in the middle has nothing to read.