I was wondering about HTTPS security and how easily is compromised. I have already read the similar threads in here, but I have some more questions:

  1. Let's say I am searching something at Google. Supposing I have a malware-free machine(but dont know if someone monitors my wire), who can view those data? Google? The Goverment? The ISP?

  2. If someone monitors the https handshake with Google, can it export useful/ private information?

  3. Is it trivial to break on a certification authority to fool it, and fool https too? As far as I know, cryptographic attacks have not that luck against HTTPS

Waiting for your feedback :)


1 Answer 1


1) Assuming that the server is also malware free, and that you aren't subject to a Man in the Middle (MitM) attack, only the client and the server can monitor the connection. It's easy to see how the session can be monitored if client or server is compromised. MitM is the real attack vector against this.

With MitM, the attacker presents the client with a certificate that purports to be the server's. The attacker effectively proxies the client's requests. This does require that the client either accept a certificate warning, the attacker has attacked a certificate authority and has fraudulently issued a legitimate SSL cert to his or herself, or that the attacker has control over DNS from the client to bypass the security checks a browser does on an SSL certificate.

2) If one monitors the handshake, and knows (or can cryptographically attack) the private key used to establish the session key for the connection, one can decrypt the SSL session. Wireshark, for example, is able to do this out of the box.

3) Successfully attacking the CA is going to get you a valid certificate for a domain of your choice. Comodo was attacked a year or so ago, and issued some bad certs for Google. This is not required to successfully attack a connection, though.

As mentioned, one can man in the middle. There have been protocol vulnerabilities in SSL1 and SSL2 that allow cryptographic attacks. The current iteration of TLS is good, as far as we know, but it is an area of crypto research. Additionally, the SSL handshake negotiates the algorithm used for encryption. Multiple weak encryption algorithms are enabled by default (there's actually a null cipher suite that does no encryption!), and if used can compromise the confidentiality of your connection.

  • 1) Does the ISP logging(as commanded by several laws) considered MiTM attack(in results perspective)? For example in EU, ISPS are obligated to keep logs of internet activity i.e urls visited, for two years. Can they actually see what I am searching in Google, as soon as it a secured connection?
    – py_script
    Commented Jun 9, 2013 at 14:44
  • 1
    To directly answer, no. They'll know you're talking to Google, but not what you're talking about (unless you click through on google to an insecure site and your referrer field leaks info). However, if your browsing information is being collected under warrant all bets are off. Commented Jun 9, 2013 at 14:49
  • you missed off good sslstrip attacks, who cares about encryption when the browser will even connect just fine without it. And most users wouldn't notice.
    – ewanm89
    Commented Jun 9, 2013 at 14:56

Not the answer you're looking for? Browse other questions tagged .