Can an anonymous proxy service capture my email password?

Short answer: quite possibly.

Longer answer: quite possibly your password and much, much more.

It depends on the proxy server, how it works, and how you’re connecting to
the sites you’re attempting to access anonymously.

First, a quick refresher on how you connect to a web site and why an
anonymizing service is interesting.

Recall that when you connect to a web site your internet IP address is
provided to the server hosting the web site:

And yes, that’s Ask Leo! in the example image because as you’re visiting
this site, your IP address is transmitted to the site. In fact, I think your IP
address is:

As we’ll see in a moment, several things can affect that, but for most
of you that’s the internet IP address of your computer or your router if
your computer is behind one.

You can’t prevent an IP from being exposed to the computers and servers you
visit. It’s the fundamental nature of the internet. Communication of IP
addresses is required to make it all work.

But you can – sort of – control which IP gets communicated and how far.

Enter the anonymization service:

Here you can see that you’re using an intermediary. Your IP address only
goes as far as the proxy service. They then turn around and make the web site
request on your behalf (hence “proxy”), exposing only their IP address
to the web site you’re visiting, not your IP address.

There are several such services, but they all share one thing in common:

You have to trust them.

•

Here’s the problem: every request you make, and every response you get is
routed through the proxy service’s servers.

Everything.

That has two exceptionally important ramifications:

1. The proxy knows your IP. If they maintain and retain access
   logs, it’s conceivable that those logs could be demanded by legal authorities
   to track activity. They’d know the IP address you were coming in from and the
   web sites that you were visiting through the proxy.

   I’d expect a “good” proxy not to keep those logs at all, but you never know.
   It’s a matter of trust.

2. The proxy sees your data. Every request you make goes to
   the proxy where it’s interpreted so that the proxy knows what to do with it
   next. While it’s looking at it, your data could be there for the proxy to
   examine and do whatever else with. So yes, if that data contains your email
   account name and password in unencrypted text, you bet a malicious proxy could
   be collecting that information.

Fundamentally you’re implicitly trusting the proxy to be a good player – both
preserving your anonymity, and not peeking at your data.

•

But what about secure connections using https?

In general, a proxied connection over https is safe from data snooping. The
proxy still knows your IP, of course, so that responses can be sent back to
you, but the data is obscured by encryption.

There are issues to be aware of and be careful with:

• Know what’s being encrypted. Quite often only the
  connection to the proxy server itself is encrypted. For example, if you’re
  connecting to https://secure.proxyserver.com?moredata then
  you’re establishing a secure connection only to the proxy server. This is
  common for services that provide secure internet access for open wifi hotspot
  users, for example, as it prevents all your data from being sniffed.

  It’s also not uncommon to configure a proxy service in your Internet Options
  in this same way. When this is done then the connection to the proxy server
  is secure even if you’re not specifying https on every website access.

  But the bottom line is that if the connection to the proxy server is secure,
  that still does not prevent the proxy from examining your data.

• Make sure it’s proxying end-to-end https connections. So
  the solution keep your data secure even from the proxy itself is to use secure
  connections end to end. For example accessing
  https://mail.google.com establishes a secure encrypted
  connection between your computer and the service. Proxies or other types of
  data interception will not be able to decipher the contents of your
  communication.

  The catch? Not all proxy services handle https. So if you make an https
  connection to your favorite site then you might be connecting directly, and thus
  exposing your IP address to the site, defeating any attempts to gain anonymous
  access.

• There’s an obscure hack that could render https insecure through
  proxies. Particularly in a corporate or other institutional
  environment where you don’t actually control your own machine, replacement
  security certificates could be installed on your machine that could
  allow the proxy server to intercept secure communications to specific https
  sites. Your browser would connect securely, but would be tricked into
  connecting to the proxy thinking it was connecting to the remote site. The
  proxy could then decrypt and examine your data before re-encrypting it and
  sending it on to the site you’re accessing.

  The only way I know of to detect this is to examine the security
  certificates of the https connection at the time you make it, and make sure
  that the entire chain of certificate trust is as it should be. Yep, this can be
  obscure and/or difficult, particularly since we don’t always know what it
  “should be”. Comparing the certificates you see at work against what you see at
  home for the same connection might be a good indicator. The good news, if you
  want to call it that, is that this is also difficult to set up correctly in the
  first place, so I believe it’s quite rare.

As you can see, it really does all boil down to trust. Just like your ISP
for normal connections, you’re giving a proxy service a tremendous amount of
access just by using them. Your IP address might not be presented to the remote
site you’re connecting to, but just by the nature of the internet it must be
presented to the proxy. And in the worst case not only can a proxy log your
accesses, a malicious proxy could typically quite easily examine your data,
passwords and all.