Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Given everything that is suspected about NSA (and GCHQ, DGSE, etc.) access to user data:

Avoiding speculation, can and do we know whether Google's recent action to make all searches use SSL encryption will actually prevent said spying?

If not, what more (in addition to what we've seen) would we need to know, to know that?

share|improve this question
3  
Not if Google has given their private keys to the NSA. –  Stephen Touset Sep 30 '13 at 17:48
add comment

3 Answers

up vote 6 down vote accepted

HTTPS, aka SSL, only protects data in transit. Google switching automatically from HTTP to HTTPS means that the search query from your browser to Google's server gets encrypted. But on Google's server, the SSL tunnel ends, and it gets decrypted. This will prevent spying only under the two following conditions:

  • The spies were indeed looking at traffic between the client machine and Google's server (as opposed to simply requesting from Google themselves a copy of the data).
  • The user actually notices that Google redirects to the HTTPS URL, and "takes offence" if the redirect does not happen.

The second case is against active spies who would do a Man-in-the-Middle attack, which is highly doable on HTTP (no SSL). Since the redirect-to-HTTPS occurs at the HTTP level, before (of course) any SSL actually occurs, then the MitM can certainly block it and maintain the illusion of a non-SSL Google server.

In any case, for a big US governmental agency like the NSA, enlisting the help of some people at Google's, to get a copy of the query data, would probably be vastly easier and more efficient than the grudging work of spying on network lines. Google, being a US-based company, would comply or be made to comply for a (small) fraction of the cost implied by generalized spying. Retrieving query data from Google themselves would also work for queries which are inconvenient to spy upon, e.g. for a connection from a non-US country to a non-US-based Google server.

Therefore, I find it implausible that enabling HTTPS would really be relevant to purported spying from NSA. "HTTPS for everybody" is more a marketing / public relations move than an actual security improvement, in the context of Google and assuming that the "enemy" is the NSA.

share|improve this answer
    
Yes, there are some techniques to bypass HTTPS encryptions while doing MITM. –  Jet Sep 30 '13 at 15:45
    
Interesting that you mention man-in-the-middle attacks, since that's exactly what the NSA is doing (not surprisingly) –  Baumr Sep 30 '13 at 16:05
1  
You're missing a third condition: Google hasn't given the NSA their private keys. –  Iszi Sep 30 '13 at 16:29
1  
Regarding your redirect-to-HTTPS comment, it's worth noting to the OP that Google uses HSTS, which eliminates the redirect entirely, after the first visit. (Of course, the first visit is still vulnerable in the way described here.) –  apsillers Sep 30 '13 at 16:39
add comment

Assuming you want to talk to Bob, any one of the following assumptions would nullify (or substantially weaken) any protection granted by HTTPS against some eavesdropping adversary:

  • The adversary has access to Bob's server records (either through cooperation, coercion, or compromise), so they can see your communications with Bob after the fact.

  • The adversary can successfully impersonate Bob, either by possession of Bob's secret key or by failure of the PKI system (e.g., they obtain a cert/keypair that claims they are Bob, signed by a CA that your computer trusts).

  • The adversary has somehow broken SSL.

None of these possibilities seem terribly far-fetched for a major national intelligence program.

One weaker concern is that a man-in-the-middle attacker could perform an SSL-stripping attack. You try to visit Bob's site over HTTP, and Bob's site promotes all incoming connections to HTTPS. However, an attacker blocks you from reaching Bob's site at all. Instead, the attacker serves you the contents of Bob's site over plain HTTP, while you are none the wiser that your connection should have been done over SSL.

This problem is mitigated by sites that use HTTP Strict Transport Security (HSTS), which tells your browser to request resources from that domain only over HTTPS. Your initial visit to the site is open to a MITM SSL-stripping attack, but future visits are not, because HTTP requests automatically turn into HTTPS requests before they leave your browser. Some browsers have HSTS instructions pre-loaded for particular sites, further eliminating the first-visit problem for those sites.

Taking into account everything I've said above, the switch to HTTPS does protect you from a casual snoop running a packet sniffer on your coffee shop's wireless network.

share|improve this answer
add comment

Let me tell you that special agencies like NSA have direct protocols to Google, Facebook, Yahoo, and to most of big and famous companies (especially to them, which can collect data about you).
They don't need your password or encryption to enter your account.
And most of that encryption standarts are modified by agencies, including SHA-256 (yes, and BitCoin used it!), and even some GSM encryption standarts (which were wide-spread in the world and a lot of providers all around the world used them!).

So, that encryptions only make you safer from hackers, until they hack them too ;)
(because everything is vulnerable.)

Here are some sources:
NSA interference in standarts, NIST and ISO
NSA designed SHA-2, the family of SHA-256 and SHA-512

share|improve this answer
1  
Do you have any reputable and reliable sources that support your claims? –  Rob W Sep 30 '13 at 16:03
    
@RobW Yes, WikiPedia. OK, I will find and put sources. –  Jet Sep 30 '13 at 16:04
    
@RobW, OK I've put some sources. Also you can find a lot just by googling. –  Jet Sep 30 '13 at 16:37
1  
I'm referring to your very first claim. That screams "speculation" to me. (everyone can edit Wikipedia, by the way, so that alone isn't a good source, unless the Wikipedia article cites another, trustworthy source). –  Rob W Sep 30 '13 at 16:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.