If HTTPS is really secure as companies tell us, how do governments manage to eavesdrop on terrorist and criminal communications? https://en.wikipedia.org/wiki/Computer_and_network_surveillance

  • a terrorist for sure know what is http and https. if https is secure so why they capture all internet traffic ?!
    – John
    Jun 24, 2012 at 20:09
  • Who says all terrorists are careful? Who says they do not have access to some of those private keys? Who says they are not using virusses? Jun 24, 2012 at 20:30
  • For email they can cooperate with your email provider. I'd expect gmail etc. to cooperate with some governments. Jun 24, 2012 at 20:39
  • 1
  • 1
    You realise that no government can sniff everything, right? Even if everything was in http only it wouldn't be possible. I have edited to remove some of the unfounded paranoia.
    – Rory Alsop
    Jun 24, 2012 at 22:11

4 Answers 4


Governments purchase spyware from private companies.

enter image description here

Some companies like VUPEN are known for building complex 0-day exploits against browsers and selling them privately to anyone for hundreds of thousands of dollars.

Recently the Obama Administration has moved to block the sale of such technology to Iran and Syria. Iran is known to be performing active MITM attacks against gmail.

  • what wikipedia says is they sniff all the internet traffic to see for example when someone say "bomb" to catch him. question is we all use https ... what is that mean !
    – John
    Jun 24, 2012 at 20:04
  • 6
    @John - don't believe everything you read on the internet...
    – Rory Alsop
    Jun 24, 2012 at 22:12

There are ways like:

  • spoofing the SSL certificate
  • compromise endpoint or beginpoint (rootkits)
  • guess the user's password
  • ...
  • so we always see a fake SSL on browser that shining green ?
    – John
    Jun 24, 2012 at 19:45
  • No, if they are spoofed then not. But it has happened that certificates were stolen (Iran). So then you have a MITM attack that actually validates. Jun 24, 2012 at 20:08
  • seems usa capture all internet traffic. something is wrong
    – John
    Jun 24, 2012 at 20:12
  • 3
    @John do you have basic understanding of how SSL works? Also do you have any IT background because I feel that you just discovered this and feel like you need to go after the government or something... Jun 24, 2012 at 20:25

The US government is known to use keyloggers, don't know if they're physical widgets in-line with the keyboard, or software. Nicodemo Scarfo, Jr was apparently convicted using some kind of keylogger data.

  • 4
    Why the downvote? I actually cited a US Federal case that the FBI had to reveal that they used keyloggers. At least have the brass to say why you're downvoting, coward. Jun 25, 2012 at 15:35

So how it works, they collect lot's of information, filter it, database it, trace you and listen to your phone, email and everything else at the same time. This gives a complete picture, so when you are using SSL, this is just a small piece which doesnt change much :-)

Also, they have the most important information, no matter how strong encryption you got - who are you talking with.

ps. When you are using SSL to buy something, maybe they cant see it, but they can see your CC payment.

ps2. Total obfuscation is not possible, even a policy with good enforcement is not enough, they can see who is sending, they can trace who is supposed to receive.

Simply you can run, but you cant hide.

  • SSL is encrypted traffic which means without the encryption key it would be useless noise. Your answer doesn't offer any FACTS.
    – Ramhound
    Jun 25, 2012 at 14:00
  • Noise signals communication, and this way attack can be launched on either of the side of the encryption and decryption, so with SSL you cant guarantee confidence for 100%. Jun 26, 2012 at 12:12
  • Why do you think that SSL can't guarantee confidence? Jul 22, 2012 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .