2

See X-Keyscore: NSA tool collects "nearly everything a user does on the internet".
http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-data

Does anyone have a clue how they collect the traffic in the first place and whether they decrypt HTTPS traffic or not? (For example, by stealing the private RSA key…)

Not many HTTPS sites use perfect forward secrecy.

How would you explain the interception of the Facebook chats? Facebook does use SSL.

Improve this question
4
  • 1
    I doubt anyone will get an official statement by the NSA — the only party which could answer that beyond any reasonable doubt.
    – e-sushi
    Commented Jul 31, 2013 at 17:19
  • 1
    Keep in mind that this operation has been going on for many years, and the web sites in question have only recently gone to 100% HTTPS.
    – Michael Hampton
    Commented Jul 31, 2013 at 21:05
  • @MichaelHampton Are you referring to Firesheep-like session cookie stealing and the CRIME and BEAST HTTPS attacks?
    – user129789
    Commented Jul 31, 2013 at 21:18
  • 1
    No, I mean that it's trivial to sniff HTTP traffic.
    – Michael Hampton
    Commented Jul 31, 2013 at 21:19

1 Answer 1

Reset to default
0

Feds put heat on Web firms for master encryption keys:

If the government obtains a company's master encryption key, agents could decrypt the contents of communications intercepted through a wiretap or by invoking the potent surveillance authorities of the Foreign Intelligence Surveillance Act. Web encryption -- which often appears in a browser with a HTTPS lock icon when enabled -- uses a technique called SSL, or Secure Sockets Layer. "The government is definitely demanding SSL keys from providers," said one person who has responded to government attempts to obtain encryption keys. The source spoke with CNET on condition of anonymity. The person said that large Internet companies have resisted the requests on the grounds that they go beyond what the law permits, but voiced concern that smaller companies without well-staffed legal departments might be less willing to put up a fight. "I believe the government is beating up on the little guys," the person said. "The government's view is that anything we can think of, we can compel you to do."

How they do it? probably like this (see wikipedia):

Room 641A is a telecommunication interception facility operated by AT&T for the U.S. National Security Agency that commenced operations in 2003 and was exposed in 2006.

and this:

GCHQ taps fibre-optic cables for secret access to world's communications British spy agency collects and stores vast quantities of global email messages, Facebook posts, internet histories and calls, and shares them with NSA, latest documents from Edward Snowden reveal

Improve this answer
2
  • 2
    Answers that contain only links are prone to link-rot, and eventually become useless. Please take a quote from the article and sum up your own thoughts on it, so that it's a proper answer.
    – Polynomial
    Commented Jul 31, 2013 at 16:10
  • 1
    How is a " company's master encryption key" supposed to work? TLS 1.2 should use Cipher Suites with perfect forward secrecy, therefore: The NSA either has to (1.) perform an active man-in-the-middle attack, via (forged) TLS certificates, or (2.) compromise the client or the server with malware, extracting the communication at one of the endpoints
    – Mike76
    Commented Mar 10, 2019 at 22:30

Not the answer you're looking for? Browse other questions tagged .