I am concerned about sending long-term sensitive information over SSL. Someone who does not have the private key could record SSL traffic (with WireShark, Fiddler or some such) and store it for several years. They would not be able to decrypt the traffic now. But later, when attacks against SSL have progressed, or when computers have become faster, they might decrypt the traffic that they have recorded.
As I understood of Google they are into temporary SSL because of such reason (the topic). Is this reality or just a way for companies to sell, by the name of security?
I may state something wrong or nearly wrong here, because i'm not super-familiar on the context. I'm glad of help if I misunderstood something or if there are details that worth extra explanation.
This of course also apply to traffic that are compromised with XSS or other ways with similiar result (listen on someones traffic).
As Google stated in their reasons, within 10 years the computers will be strong enough to decrypt this traffic. I'm sorry I do not have a link to an English news page on this topic. Does this mean that our traffic can be listened on today and be archived? Then when the time is right, the data is decrypted by brute force, even if the eavesdropper has not been able to obtain the private key?
Do we need to care? When and how? May it apply to other situations then just http traffic, where data are transferred encrypted with a very high trust (by human)?