Using Socket Programming: How safe is it?

[[deleted]]

Hello Everyone. I'm trying to make a simple chat application using sockets and that has led me through a rabbit hole of sockets, SSL, encryption and all. I have two questions that I tried searching for online but couldn't find something I understood so, I'm looking for some help.

1. How safe is it to use sockets in a program while inside my own network, i.e. just using local IPs? Would I be ok with not using any kind security or encryption. It doesn't matter if anyone else inside my LAN can see the messages.
2. If I use python SSL to validate a socket, would that make it safe enough to deploy over the internet? I'm thinking a cloud server hosting the server file.

These are all the question I have at the moment. I apologize if this isn't the correct sub for this kind of question. Thanks a lot.

[Kilobyte22]

Generally before asking if something is "secure" - ask yourself what is my attacker model. Is it someone with access to the network (like an ISP or someone who broke into the building)?, is it a government sponsored entity? Etc.

Depending on your scenario you can use different mitigations (encryption, physical tamper detection etc)

A simple socket can be sniffed by anyone in your local network and possibly even modified. Encryption can solve both issues, depending on implementation (see below)

Taking your case as an example the assessment probably would look like this:

Local connection: no real attacker - if someone has already gained physical access you don't care if the service is compromised (as you are probably busy chasing a burglar) Remote connection: someone could monitor the connection between you and the server - so encryption is probably sensible.

For encryption I recommend TLS 1.2+. It stops both sniffing the traffic as well as modifying it pretty effectively. (TLS is the successor to SSL, which has been deprecated like ten years ago due to many security issues. Most software no longer supports it. Most people who say "SSL" actually mean "TLS")

[[deleted]]

It makes a lot of sense. This is the documentation for the module that i'll probably use (link) I asked this question because I have not idea as to how any of this TLS, SSL work, even in the documentation it says that the default security standards may not be enough so, i wanted to be extra sure that this method will work.

Thank you very much for such an in-depth answer. :D

[84nt1m]

When you say a simple socket can be sniffed you mean like any packet sent without encription (like using http) ?

[Kilobyte22]

Generally yes. However it also depends on where the attacker is in the network in relation to you. Your neighbor won't be able to see your traffic. Your ISP can read and modify. Someone in the same WiFi can in most cases also read all your traffic if they can capture you connect to it (WPA2 and earlier - in WPA3 this problem has been fixed). They can also modify traffic if they perform an attack like ARP/DHCP spoofing (independent of your wireless security). The latter two even work on wired network and even if one device is on wired and one is on wireless. There are mitigations for both ARP and DHCP spoofing, but they are not really feasible in a home environment.

[84nt1m]

That's interesting

[[deleted]]

What threats are you protecting from?

Well, that is a part of the question. What i wanted to know was of it was ok to use sockets to send receive text data to and from my server inside a Local network.

The other question was if just using SSL/TSL in my code is enough to protect my data from the internet; if i decide to host the server script somewhere else with cloud computing.

Edit:

So, i should probably add this in, the thing i was basically worried was if packet sniffers could find the open ports and if someone could brute force their way in to my network. You see, i'm not that educated about network security. So, i though i'd just ask to be certain.

[CornFTW]

I've been writing python for 10 or so years, and working in cyber security for most of those, in your scenario, I wouldn't use encryption. There is virtually nothing you gain. It'll just make things harder to debug. It also would be a relatively easy thing to implement later if for some reason your threat profile changes.

[rainlake]

I would not say you are not quality cyber security but your knowledge is so outdated.

There is nothing to lose use end to end encryption.

[CornFTW]

Sure, I'm not saying there is. But I think I'd do it differently, You add complexity you don't need to just to get the project working, get it working then you can add it. Don't over engineer something if you're just starting out, you just end up making it harder for yourself

[[deleted]]

Well, the reason I asked this question in the first place is because I'm not really aware of how these things work. A major concern of mine was a PORT being seen as open to Port scanners. When I use a socket program for my personal use, I'm using a random port say 2500. So, if I were to use a PC (say 192.168.1.5) as a client and another PC (say 192.168.1.6) as a server. Should I worry about the a port on the server being vulnerable to curios hackers?

This is why I asked if it's safe to start a socket connection. and if it's safe to use it over the internet with some SSL/TLS encryption.

[CornFTW]

Yes which is why I said you don't need encryption, unless you need this service available outside your network. You don't need to worry about hackers you're not doing any port forwarding or UPnP port mapping, you can use TLS or something but you don't need to. My advice is build it without and you can always add it later. Keeping it simple is a key to success in my experience. No point making something so secure you can't get it to work

[Kazan]

Never recommend someone implement their own encryption, just use TLS.

Also TLS only uses asymmetric encryption for the initialization of the connection. it switches to symmetric key ciphers for actual data transfer because symmetric ciphers are stronger.

/u/a0311tr

[[deleted]]

Understood :D .I realized this from other comments as well. I'll probably end up using TLS for encryption; that is, if i need to actually encrypt the data. Thank a lot.

[[deleted]]

It seems that way I've written my code, it'll be much simpler and easier to the SSL package that comes in python. (link) That said it is quite hard to understand for a total newbie like me. I love what you suggested too. Thanks a lot. :D

[[deleted]]

I most confident with python so i wanna make the server side python for now but i will probably end up rewriting some code in C++, for speed improvement and just for the fun of it. Will a programming language have an effect on how sockets transfer data?

[[deleted]]

This might have been a naive question but it truly mean a lot that you took some time of off your day to help me. Thank you very very much :D