Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Here where I live, it is believed that all the internet traffic goes through the hands of government agencies, and the telecommunication office is actually owned by the government.

Given the situation, I have some concerns:

  1. Can government agencies tamper with the websites that use HTTPS? How secure is the login data that is sent through HTTPS?

  2. Is using HTTPS enough to prevent them from knowing the details about our emails (i.e. the subject, receivers, and the content)?

  3. And here is the broad question: What practical security knowledge should I try to obtain to best protect my privacy? Right know I know about GnuPG, OTR, Tails, and trying to understand some basic concepts like MitM attack, etc.

share|improve this question

closed as too broad by GdD, Adnan, Xander, Noordung, Terry Chia Jan 23 at 15:11

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

up vote 2 down vote accepted

SSL protects the confidentiality of your data if both the client (your machine) and the server (the Web site you are talking to) follow the protocol and are free from direct modifications. However, if (for instance) your enemy managed to install a root CA that he controls within your "trusted store" then he can produce fake certificates at will, for all Web sites that you contact. That is a Man-in-the-Middle attack: the attacker impersonates the server, so the data you send goes to the attacker, and what you see is what the attacker sends you; simultaneously, the attacker connects to the genuine server, posing as the normal client (you), and transfers data back and forth. So your requests ultimately go to the intended server, and its responses come back to you, and everything seems to go well, but the attacker gets to see all the unencrypted data.

Therefore, if the target site is out of reach of your enemy, and your computer is "clean" (bought outside of the country, including the OS, and no malware installed), then you might be fine. But these conditions are not so easy to achieve.

For emails, they are not transmitted with HTTPS. When you access your emails "with HTTPS", you are using your Web browser to access a Web-based interface on a server where your emails wait for you. But no HTTPS was in force when the said email transited from the sender's machine to that server. Emails hop from server to server and, as a rule, travel unprotected (some servers opportunistically apply some SSL protection, but this is not guaranteed, not necessarily done well, and emails are still stored unencrypted, if only transiently, on the intermediate servers). Therefore, if you read and write emails through a Web-based interface that you access only with HTTPS and that HTTPS is clean (see above) and the server which contains your mailbox is out of reach of your enemy and the people with which you exchange emails are also out of reach of your enemy, then it is conceivable that your enemy will not be able to read your incoming and outgoing email, nor guess with whom you are communicating. There again, these are big ifs...

Privacy is not confidentiality. For instance, when you connect to an HTTPS Web site, your enemy will not be able to see the data that you send to that site and what the site sends back (assuming a clean client and a clean server, as explained above). However, your enemy will be perfectly aware that you are exchanging data with that specific Web site. He will not when you connect, and he will see the size of all requests and responses, and can therefore make some good guesses as to what you are doing on the site. That's called traffic analysis. SSL ensures confidentiality and integrity, not "privacy" in a broader sense.

Also, if your enemy is a government, then chances are that he does not care at all about your actual password. Obtaining your password makes sense only for attackers who wish to impersonate you, connecting to your accounts on external servers. This leaves traces; spying agencies, as a rule, don't like that. Passive eavesdropping, or maybe traceless MitM, are more in character for them.


All of the above assumes that your enemy is extremely powerful but geographically limited; he can hijack telecommunication infrastructures at will throughout his country, but becomes powerless beyond the boundaries. This is a somewhat simplistic assumption. If the attacker is intent on unravelling your secrets, then he may also indulge in active hacking worldwide, trying to find and exploit vulnerabilities in external servers just like any amateur attacker.

share|improve this answer

Here where I live, it is believed that all the internet traffic goes through the hands of government agencies, and the telecommunication office is actually owned by the government.

so i assume you're either in EU-europe or US of A? (scnr)

to your questions:

  1. yes, tampering is possible, either as man in the middle as well as later decoding of recorded traffic. your login-data is doomed

  2. no

3.

  • have no trust in privacy on the internet (no tor, no i2p, no nothing)
  • keep as much traffic out of the internet as you can
  • be aware of the meta-data-problem (they are stored, anyway)
  • learn about how you're tracked
  • learn to stay invisible (e.g. avoid to be tracked by the big players)
  • learn end-to-end-encryption
  • keep informed
  • tbc

sorry to be that pessimistic, but the internet is broken and wont be fixed soon :(

share|improve this answer
    
No, I live in a country in the Middle East (where the Big Brother is watching so closely). As for your answers, it would be great if you could give me more practical information. My login-data is doomed, just like that? Should I believe that there's no way out? If using HTTPS is not enough to protect my email privacy, isn't there any more sophisticated way to deal with that? And if there really isn't, at least let me know why it's can't protect me and in what way my privacy is at risk (especially for emails.) –  Little moon Jan 23 at 8:38
    
this might be more a topic for a chat; i dont know, if your data is doomed, but you must assume it. HTTPS does not protect against governmental agencies. it depends on your requirements what solutions to use; there are some, but staying below the radar is quite a hell of a job –  that guy from over there Jan 23 at 9:39
    
I don't see any option to chat in this forum (or maybe you was just kidding anyway). Can you please name those solutions, so that I can search for info about them? –  Little moon Jan 23 at 9:53
    
@Littlemoon click on the StackExchange button on the very top of the page and click on chat for the given stack exchange site to get to it. –  Samuel Jan 23 at 10:10
    
@Samuel thanks, but it has stated that You'll need 20 reputation to talk here. –  Little moon Jan 23 at 10:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.