What is Man-in-the-Middle Attack?
A man-in-the-middle (MITM) attack is a cyberattack where an adversary secretly intercepts and potentially alters communications between two parties who believe they are communicating directly with each other.
Also known as: MITM, MITM attack, on-path attack
MITM attacks exploit the trust inherent in network communication. The attacker positions themselves between a client and server — often by compromising a network hop, poisoning DNS or ARP tables, or setting up a rogue Wi-Fi access point. Once in position, they can eavesdrop on traffic, steal credentials, inject malicious content, or modify data in transit without either party detecting the interference.
TLS/SSL is the primary defense against MITM attacks on the web. When properly implemented with certificate validation, TLS creates an authenticated, encrypted channel that prevents an intermediary from reading or tampering with the data. However, TLS only protects data in transit between a client and server — it does not prevent the server itself from reading the data once decrypted.
For truly sensitive information, end-to-end encryption provides a stronger guarantee. Even if an attacker compromises a TLS connection or the server infrastructure, they cannot access plaintext data because only the intended recipient holds the decryption key. This defense-in-depth approach — TLS for transport security plus E2E encryption for data confidentiality — is considered best practice for high-value secrets.
How Vaulted uses Man-in-the-Middle Attack
Vaulted defends against MITM attacks through two layers. First, all traffic is served over TLS, preventing network-level interception. Second, and more importantly, Vaulted uses client-side end-to-end encryption with AES-256-GCM — the encryption key is never transmitted to the server and exists only in the URL fragment (which browsers do not send in HTTP requests). Even if an attacker intercepts the server communication, they receive only ciphertext with no means to decrypt it.