Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite

For example, if I did an ssh -X to localhost and invoked Firefox, would that be enough to be considered safe browsing, like if done on some public wifi?

share|improve this question
6  
This would just encrypt the connection between you and localhost (your machine) but has nothing to do with safe browsing. It will not encrypt traffic in and out. Firefox will fetch what you browse as usual (HTTP or HTTPS depending on what you do) – Matteo Jun 16 '12 at 7:18
2  
What's worse, it would pipe X through TCP (rather than shared memory), disabling a ton of optimisations, and would make the browser slower (on top of the pointless encryption/decryption). – Alexios Jun 16 '12 at 11:08

3 Answers

up vote 7 down vote

No, it will not help. All it does is set up an encrypted connection to your local machine, and from there, connects to the outside world exactly like it would have without the local ssh - you gain nothing, but performance is going to suffer (after all, ssh does encrypt and decrypt all the X11 messages that firefox and the X11 server pass back and forth).

ssh forwarding is useful if you are on an untrusted network (e.g. a public wifi), but you have a server with a trustworthy internet connection available elsewhere (e.g. your home broadband). In this scenario, you would ssh into the server at home, forwarding all your traffic through this server. The communication between you and your home server is secured by ssh; from there, it is just as secure (or insecure) as it would be if you were browsing from home. To the server at the other end, it will look as if the traffic came directly from your home network.

On a side note, X-forwarding firefox is a terrible way of doing this; firefox doesn't exactly play nice with X11 messages, basically assuming that it runs locally - I have never seen firefox perform well when running on a forwarded X display. A much better way is to just use ssh's dynamic port forwarding; for example, you can issue ssh my.home.server.net -D:8080, and then configure firefox to use a socks proxy at localhost:8080. Firefox then still runs locally, but the web traffic goes through ssh. If you are in doubt whether it is working correctly, go to whatismyip.org to check your IP as seen on the receiving end.

share|improve this answer
up vote 3 down vote

Answer

No, it is not useful. If your goal is to protect your data in transit over the WiFi connection, then an encrypted tunnel over your loopback interface does not serve that goal.

Research Hints

This is not a comprehensive list, but it will get you started as you search for a good solution for protecting your data in transit.

  • SSL
  • TLS
  • IPSec
  • SSH SOCKS Proxies
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.