2

I would like to ask a question that I have about MQTT client broker communication. Let's say, a client C1 is connected to the broker with user name and password (with no encryption).

What happens when a new client C2 (a malicious one) tries to publish or subscribe to a topic without actually initiating connection and pretending to be C1? Are there any means by which the server can figure out that C1 is not the one trying to communicate?

This question arises because after the connection process, the broker does not really check for credentials each time it is trying to subscribe or publish to a topic (as far as I am aware - may be wrong altogether).

  • perhaps you may wish to ask about credential checking instead, since that appears to be the actual knowledge gap – jsotola Oct 19 at 16:04
5

As with nearly any unencrypted protocol, there is no man in the middle protection.

If this is a treat model you need to protect against then running MQTT over SSL/TLS is the solution.

| improve this answer | |
  • Using Secure MQTT with SSL is definitely a great option. Provisioning the cryptomaterial is the hurdle we actually have. Thanks for your comment. – Rijo Varghese Oct 20 at 12:58
  • All you need to provide for basic TLS support is a CA certificate, assuming a long enough life time for that cert that shouldn't be a problem. Unlike having to security distribute private keys for TLS client authentication – hardillb Oct 21 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.