Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question is an exact duplicate of:

Can you guess how the NSA can read Facebook chats, while Facebook does use SSL encryption? Requesting information directly from the Facebook HQ is possible (see also who betrayed Facebook in favor of the NSA), but if you read the details of this program you will see that they are talking about the raw TCP packages.

"enables an analyst using XKeyscore to read the content of Facebook chats " http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-data

PS:

Former Facebook security chief is now working for the NSA

Read more: http://www.dailymail.co.uk/news/article-2347047/Former-Facebook-security-chief-working-NSA.html#ixzz2aekPnnJS

share|improve this question

marked as duplicate by TildalWave, Xander, Iszi, Adnan, Eric G Jul 31 '13 at 20:08

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

SSL only protects communication between your system and Facebook's system. Since Facebook is a willing participant, they simply provide access to their database which stores the conversations in the clear.

share|improve this answer
    
Yes, but If you read the details of this X-Keyscore program, you will see that it talks about raw TCP/IP packages. –  user129789 Jul 31 '13 at 19:54
    
@user129789 - no where in the linked article did it say anything I could find about TCP/IP. In theory, depending on the type of SSL, if the private certificate was shared, then the SSL key exchange could be decoded and HTTPS traffic could be directly decoded, but this would still be due to collusion on Facebook's part. Facebook is in the business of selling your information, this really shouldn't be a surprise. –  AJ Henderson Jul 31 '13 at 21:44

This seems simple enough: SSL is just between your computer and the Facebook servers. The Facebook servers, by construction, see all the data unencrypted. If I were the NSA, I would simply request from Facebook themselves a copy of the whole lot.

share|improve this answer
    
Yes, but If you read the details of this X-Keyscore program, you will see that it talks about raw TCP/IP packages. –  user129789 Jul 31 '13 at 21:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.