a man-in-the-middle attack
Imagine you pass notes to a friend through a classmate in the middle. You trust them to relay faithfully — but suppose they secretly read every note, and even rewrite some before passing them on, while telling each of you that the other agreed. Neither of you realizes there's a third party in the loop. A man-in-the-middle (MITM) attack is precisely this: an attacker secretly positions themselves between two parties, relaying their messages while reading and possibly altering them, so each side believes it's talking directly to the other.
It works by impersonating each end to the other. A classic web MITM goes like this: the attacker gets onto the path (via ARP spoofing on a LAN, a rogue Wi-Fi access point, or DNS spoofing). When you try to reach a site, the attacker answers as if it were the server, and separately connects to the real server pretending to be you. Now two encrypted-looking connections exist — you-to-attacker and attacker-to-server — and the attacker sits between them, able to read everything in plaintext as it passes through. The whole trick depends on you not verifying the other end's true identity.
Why it matters: MITM is the reason authentication, not just encryption, is essential. Encrypting to 'whoever you connected to' is worthless if that party is the attacker. TLS defeats MITM by having the server present a certificate signed by a trusted authority binding its identity to its public key — if the attacker can't produce a valid certificate for the real site, your browser refuses or warns. This is also why certificate warnings matter and why clicking through them, or trusting a network that asks you to install its own 'root certificate,' can hand an attacker the middle seat.
On cafe Wi-Fi, an attacker uses ARP spoofing to make your laptop send all traffic through their machine. They intercept your request to your bank and try to impersonate it. Because the bank uses HTTPS and the attacker can't forge a valid certificate, your browser shows a security warning instead of letting them in — the certificate check stopped the MITM.
Encryption alone isn't enough; identity must be verified.
A common misconception: 'it's encrypted, so it's safe.' Encryption protects against listening, but not against an attacker you mistakenly authenticated to. Defeating MITM requires verifying the other end's identity — which is exactly what certificates do.