A man-in-the-middle attack doesn't try to break the lock on either end of a conversation. It slips into the middle of the conversation itself, intercepting messages between two parties who each believe they're talking directly to the other — reading everything that passes through, and often altering it, without either side noticing anything is wrong.
Why it works: neither side can see the whole path
When your device connects to a website, the connection typically passes through several intermediate points — a Wi-Fi router, an internet service provider, various network hops — before reaching its destination, and you have no direct way of verifying that every one of those points is trustworthy. An attacker positioned at any of these points, or one who tricks your device into routing traffic through a device they control, can intercept the conversation. A classic version: an attacker sets up a fake open Wi-Fi hotspot in a public place, and once a device connects to it, every unencrypted request that device makes passes through the attacker's machine before continuing on, letting them read it, log it, or modify it in transit.
Encryption doesn't stop the interception — it stops the reading
An attacker positioned in the middle of a connection can still see every packet passing through, whether or not those packets are encrypted — encryption doesn't prevent interception, it prevents the interceptor from making sense of what they've intercepted. This is why HTTPS (the padlock icon in a browser) matters specifically against this attack: it encrypts the content of a connection so an intermediary can see that a conversation is happening but not read its contents, and it uses digital certificates to let your device verify it's actually talking to the real destination and not an impostor inserted in the middle. Without that certificate verification, a sufficiently well-positioned attacker can even impersonate the destination itself, presenting a fake identity that looks legitimate to a device that isn't checking carefully.
What we're still unsure about
Modern encryption and certificate verification have made man-in-the-middle attacks significantly harder to pull off successfully than in the early, mostly-unencrypted internet, so this isn't a fight security has been losing. The genuinely unresolved tension is at the edges of the system: certificate authorities, the organisations trusted to verify that a website is who it claims to be, occasionally get compromised or make mistakes, and users routinely click past security warnings their device correctly raises, which means the technical defence can be sound while the human or institutional layer around it still gets exploited — a gap security researchers describe as a persistent, moving target rather than a problem with a fixed, final solution.
This sits inside Network Attacks & Defences (MITM, DDoS, Firewalls), one of seven topics in Cybersecurity, one of seven domains in Computer Science, one of seventeen subjects the app can quiz you on.