Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite
2

If https is really secure as companies tell us, how do governments manage to eavesdrop on terrorist and criminal communications? http://en.wikipedia.org/wiki/Computer_surveillance

share|improve this question
a terrorist for sure know what is http and https. if https is secure so why they capture all internet traffic ?! – John Jun 24 '12 at 20:09
Who says all terrorists are careful? Who says they do not have access to some of those private keys? Who says they are not using virusses? – Lucas Kauffman Jun 24 '12 at 20:30
For email they can cooperate with your email provider. I'd expect gmail etc. to cooperate with some governments. – CodesInChaos Jun 24 '12 at 20:39
You realise that no government can sniff everything, right? Even if everything was in http only it wouldn't be possible. I have edited to remove some of the unfounded paranoia. – Rory Alsop♦ Jun 24 '12 at 22:11
show 1 more comment

4 Answers

up vote 2 down vote

There are ways like:

  • spoofing the SSL certificate
  • compromise endpoint or beginpoint (rootkits)
  • guess the user's password
  • ...
share|improve this answer
so we always see a fake SSL on browser that shining green ? – John Jun 24 '12 at 19:45
No, if they are spoofed then not. But it has happened that certificates were stolen (Iran). So then you have a MITM attack that actually validates. – Lucas Kauffman Jun 24 '12 at 20:08
seems usa capture all internet traffic. something is wrong – John Jun 24 '12 at 20:12
3  
@John do you have basic understanding of how SSL works? Also do you have any IT background because I feel that you just discovered this and feel like you need to go after the government or something... – Lucas Kauffman Jun 24 '12 at 20:25
up vote 3 down vote

Governments purchase spyware from private companies.

enter image description here

Some companies like VUPEN are known for building complex 0-day exploits against browsers and selling them privately to anyone for hundreds of thousands of dollars.

Recently the Obama Administration has moved to block the sale of such technology to Iran and Syria. Iran is known to be performing active MITM attacks against gmail.

share|improve this answer
what wikipedia says is they sniff all the internet traffic to see for example when someone say "bomb" to catch him. question is we all use https ... what is that mean ! – John Jun 24 '12 at 20:04
4  
@John - don't believe everything you read on the internet... – Rory Alsop♦ Jun 24 '12 at 22:12
up vote 1 down vote

The US government is known to use keyloggers, don't know if they're physical widgets in-line with the keyboard, or software. Nicodemo Scarfo, Jr was apparently convicted using some kind of keylogger data.

share|improve this answer
3  
Why the downvote? I actually cited a US Federal case that the FBI had to reveal that they used keyloggers. At least have the brass to say why you're downvoting, coward. – Bruce Ediger Jun 25 '12 at 15:35
up vote -3 down vote

So how it works, they collect lot's of information, filter it, database it, trace you and listen to your phone, email and everything else at the same time. This gives a complete picture, so when you are using SSL, this is just a small piece which doesnt change much :-)

Also, they have the most important information, no matter how strong encryption you got - who are you talking with.

ps. When you are using SSL to buy something, maybe they cant see it, but they can see your CC payment.

ps2. Total obfuscation is not possible, even a policy with good enforcement is not enough, they can see who is sending, they can trace who is supposed to receive.

Simply you can run, but you cant hide.

share|improve this answer
SSL is encrypted traffic which means without the encryption key it would be useless noise. Your answer doesn't offer any FACTS. – Ramhound Jun 25 '12 at 14:00
Noise signals communication, and this way attack can be launched on either of the side of the encryption and decryption, so with SSL you cant guarantee confidence for 100%. – Andrew Smith Jun 26 '12 at 12:12
Why do you think that SSL can't guarantee confidence? – Andrey Botalov Jul 22 '12 at 9:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.