Is the device endangered (wiretapping/traffic interception) in this case?

Question

iPhone

Let's say an ios device, such as an iphone, connects to a wi-fi access point, which can be potentially dangerous (wiretapping / traffic interception).
The access point is located in a cafe, metro, company where a person works.
So, a person connects to wi-fi through such an access point and enters, for example, VK, Twitter, a task manager or any other similar application where he has already logged in.
Is it possible in this case to listen / intercept traffic from an iOS device?
For example, find out the username and password, steal cookies, etc.?
PS It is unlikely that an ios device is very different from an android or a PC, but still it is it that is of primary interest.

Answer 1

listening to HTTPS traffic is very simple and very possible. But what will you do with meaningless streams of encrypted information without a key? :) And the interception of certificates will no longer work - almost all modern browsers will not let you in unless you specifically add the site to the exceptions.

Answer 2

twitter - no
task manager - yes if it doesn't use https

Answer 3

Maybe, but on iPhones it is possible to configure openvpn, then it will be impossible to listen to traffic from the browser. As far as we know, facetime does not go through vpn

Answer 4

PS It is unlikely that an ios device is very different from an android or a PC, but still it is it that is of primary interest.

For some reason, it also seems so to me, because. network protocols, browsers, HTTP, etc. - are standardized and approximately the same on all devices... Or do you think that the average software in iOS devices is strikingly worse than on android, PC, etc., has a number of potentially critical flaws and is more vulnerable?

Is it possible in this case to listen / intercept traffic from an iOS device?

HTTP traffic, I think so. HTTPS traffic, in theory - no. And this does not depend on the "level of danger" of the point itself, any point (both "dangerous" and not so) is an intermediate link on the path of your traffic, and there will be quite a lot of such links in its path. But, encryption usually saves from prying eyes, regardless of devices.
PS Relatively recently, there was information about dependencies in WPA2, which also generally affects all devices, regardless of the "danger level" of the access point and end client devices.

Answer 5

as mentioned above, you can safely transfer data via https
BUT on the condition that if you are slipped a left certificate, you do not click "well, ok, accept ... what's wrong with that"
https://ru.wikipedia.org/wiki/%D0% A6%D0%B5%D0%BD%D...
https://www.youtube.com/watch?v=PYPCU4vyjfM&list=P...
https://www.youtube.com/watch?v=7l67fXkWyxs

Answer 6

Apparently the moderators don't like links to telegram channels, I'm writing for the third time. So, the answers WITHOUT links:
- Yes, you can intercept traffic.
— Yes, devices are endangered.
As a rescue for the iPhone, Wingy is optimal.

Answer 7

The encryption built into WEP/WPA2 is reversible if an eavesdropper has the password for that network and a handshake of your connection, no matter what type of device you have.
If the application uses unencrypted channels or does not stop working if Man-in-the-Middle is suspected (in the case of HTTPS, certificate spoofing), then its traffic can be received. Again, regardless of the device. Logins, passwords, cookies, etc. in the case of HTTP are transmitted in the same way.