man-in-the-middle
termsecurity
An attacker positioned between two parties who each believe they are talking directly to the other, able to read and alter what passes.
The formal definition calls it active wiretapping: the attacker does not merely observe but terminates each side and can modify what it forwards. The position can be reached by lying on the local network, by controlling a router or wireless access point, by poisoning name resolution, or simply by being the proxy the user configured. That last case is why the term needs care in professional use - a developer's debugging proxy and a corporate inspection appliance perform the identical operation and are not attacks, because consent was given. Encryption does not prevent the position; it prevents the reading, and only for as long as the certificate presented is not one the client will accept. That is why the defences are all about identity rather than confidentiality: certificate pinning, mutual authentication, and the transparency logs that make a wrongly issued certificate visible. Some organisations now write it as machine-in-the-middle or adversary-in-the-middle to avoid the gendered term.
Also known as: man in the middle, mitm, machine-in-the-middle, adversary in the middle