Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
There are exerpts, that say that using https can be broken by the NSA by now.
So is https still a solution for secure web-browsing?
Encryption techniques used by online banks, email providers, and many other sensitive Internet services to keep your personal data private and secure are no match for the National Security Agency
Basically, the NSA is able to decrypt most of the Internet. They're doing it primarily by cheating, not by mathematics.
Now, your question is "So is HTTPS still a solution for secure web-browsing?"
The answer is, as safe as it ever was, unless your opponent is the NSA. The reports you're referencing do not identify a generic weakness that can be taken advantage of by random actors, by organized crime, by your ex-wife. There's no systemic failure here, just proof that a sufficiently funded, authorized, and skilled attacker can compromise lots of endpoints. And we knew that.
People say a lot of things. Not everything is true, of course.
HTTPS is HTTP-within-SSL. SSL, now known as TLS, is about the best publicly known encryption and integrity protocol for bidirectional streams of bytes. What this means is that there is no publicly known way to break it, provided that it was implemented and deployed properly (I admit that it is a big "if").
This implies the following:
If the NSA, or any other scarecrow entity that you choose to be your personal nemesis, can break SSL, then they know something that the rest of the World does not. This is advanced technology. History shows that advanced technology is, in the long run, irresistible. Therefore, resistance is futile.
If some people claim that NSA can break SSL, then this means that not only the NSA knows something more than the general public (i.e. experts in the field); it also means that these people are savvy to that secret knowledge, too. This raises the question of how they would know it. Either they are also members of some powerful and secret organization (and then, why would you trust them ?), or what they say is pure speculative baloney.
What works very well, though, it not breaking the cryptographic protocol upfront. Bribing an intern on the server side is so much cheaper. It would make no sense for the NSA to invest billions of dollars into cracking algorithms, when a few thousand bucks in the right pocket would do the trick.
This idea of NSA breaking algorithms is what I call the gaming fantasy. It emerges in the mind of people who like video games. A game has rules. Rules are a real comfort for a troubled mind. Here, the proponent of that theory will implicitly, but strongly, assume that since he uses a given cryptographic protocol (say, SSL) to secure his data transfers, his arch-enemy is thereby constrained to act only at a logical level and to defeat him on the ground of cryptography only. This is the fantasy of a basement-dwelling geek who wants to believe that his living habits are an actually efficient survival strategy.
(I blame the Matrix for that.)
There are a number of attacks on HTTPS in practical use, that the NSA probably or plausibly has:
Given the number of CAs in the world, it is pretty well certain that some of them are either knowingly or unknowingly subverted by the NSA. It would be very hard to rule out that one or more of the organizations trusted by browsers are actually NSA founded and operated. So most likely the NSA can issue itself certificates for any domain it pleases, in any name it please, that your browser will accept. Even if you check the name of the organization in the browser address bar, you probably don't check that the issuer is "the right one" for your bank. That's kind of what certificate pinning is about.
Heartbleed. The NSA may well have known about it up to 2 years before the rest of the world, which would mean that a hefty proportion of sites were subject to leaking their admin passwords and/or certificate private keys. In some sense heartbleed is over now, but not every site that was possibly vulnerable has revoked its old certificates, and it's a warning that show-stopping flaws can be undetected for years. There could be more.
Hacking operations. The NSA can throw every attack in the book at a server, plus some attacks only in its own secret books, in attempt to control the machine or acquire its private key. The same goes for the client. Of course this doesn't necessarily lead to an attack "on HTTPS", it might capture/control the decrypted traffic, but it still means that HTTPS does not imply "hidden from the NSA".
Physical operations. I suspect this is rare overall, never mind incredibly unlikely to be used on you or me, but the NSA can send guys to do stuff. As can related organizations such as the CIA or law-enforcement. The FBI and US Attorneys have shown in the past that they're prepared to accept intelligence from spooks in criminal cases and lie to a court about its source. It seems likely to me that under extreme circumstances they would be equally prepared to perform ostensibly criminal acts to enable NSA surveillance. An overseas CIA operation to do likewise probably wouldn't even be a crime in the US. Naturally it might well be a local crime, but breaking local law is kind of the point of the CIA ;-)
The NSA has the most effective known man-in-the-middle capacity. It has, as it were, its own boxes in the major internet routes: undersea cables, ISPs and suchlike. According to some of the Snowden documents it has working systems to actively intercept connections between specified endpoints. This alone is not sufficient to break HTTPS of course, but combined with factors above it means that whatever keys they obtain do translate to practical attacks.
The article you link to talks about Bullrun and other related programs. The fact that the NSA takes multiple approaches suggests that they don't have an all-purpose point and click break of SSL or its algorithms, at least not one that's cheap and practical to widely deploy. It's difficult to really understand the NSA's strategic assessments, but one might think that if they had that then they wouldn't need to take the risk of collaborating with big internet companies on specific subversions. Bruce Schneier (and probably others) has highlighted documents that refer to a trade-off performed by the NSA to judge whether a particular target is valuable enough to justify using certain attacks, especially attacks whose frequent use would tend to lead to them being discovered. I forget the details.
You can argue that "stealing someone's private SSL key" or "becoming a CA" isn't "an attack on HTTPS", but it really is for what lay people usually mean by "HTTPS". It's not an attack on the algorithms used, but HTTPS isn't just the algorithms, it's the whole system. Including the rather sprawling key distribution mechanism.
Whether HTTPS is a solution for secure web-browsing is another matter. If you're a US citizen, then your duly elected government has determined that it is perfectly "secure" to have your internet traffic observed by the NSA. Indeed, more "secure" than allowing the bad guys' traffic to be unobserved. The definition of "bad guys" is widening now that the NSA doesn't address itself solely to foreign threats as originally mandated, but also to domestic security and criminal concerns. The same applies in other countries, especially those close allies of the US who share intel with the NSA. Wooo!
It's relatively unlikely that the NSA cares about you or me in particular. Based on what we've seen of the Snowden documents it's relatively likely that if they can intercept and decrypt a particular piece of traffic with minimal marginal effort, then they will, and as such it seems likely that a good proportion of innocuous HTTPS traffic is not "secure". Naturally most of that data never reaches a human analyst, but it's available.
For me the significance of the Snowden documents wasn't that any techniques in it left people thinking, "that's amazing, we never knew that was mathematically possible". AFAIK no specific cryptographic techniques have been revealed. The news was the confirmation that the NSA has worked itself far into the infrastructure, so that security fails even without a genuine "cryptographic break".
@gowenfawr has it right: for normal use TLS/SSL is safe to use, if implemented properly. When the NSA is in play, forget about it.
https can be used in a secure way, which even the NSA can probably not break at the moment. But this does not mean all use it this way. Also, there are implementation problems (like heartbleed). And even if https itself and its usage are completely NSA proof their are still enough web application problems unrelated to https, because https only secures the transport of the data, not the application logic or data storage. And as long as the data are stored at the provider in clear (like mails) they can simply invoke the law to get access to this data.
In summary, https can be used in a secure way, but its usage is only a small (but essential) part of the overall web-browsing security.
