1

This is a bit of a vague question, but it seems relevant these days with the information on all those "mass spying" programs getting leaked. I will describe the scenario and I just want to know if it is possible under current laws (specifically, US laws but I would be interested in laws of other countries also), and if so the likelihood of it already having come to pass:

A major corporation with a major website (let's say Yahoo) receives a notice that one of their users is under investigation and they are asked to release all relevant info on said user. Not wanting to cause trouble, they politely comply and nobody except for the government organization and a few people at the company knows what took place. Some time goes by and they are contacted again, this time being told that the user under investigation has taken measures to obscure his/her identity and they are not able to pinpoint them to any one username. They are, however, able to tap the user's line and need the website's private key in order to decrypt that user's traffic. The company hesitantly agrees, the investigation finishes, and the government organization thanks them for their help. However, it's not over. The government organization has in their possession the private key that protects millions of users' data and could pass it around secretly to other entities. If it were given to another government organization that had set up the means to intercept data on a mass scale, they would be able to secretly decrypt all data to and from that website without any billion-dollar supercomputer.

A few incidents like this, and ALL the private keys for the world's top websites could be collected (and it doesn't seem like a very unlikely scenario to me...) What do you think?

closed as primarily opinion-based by Xander, schroeder, Mark, Rory Alsop Jul 3 '14 at 7:09

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    There has already been a lot of news on this point: cnet.com/news/… – schroeder Jul 2 '14 at 22:59
  • Thank you for the link to that article. It answers most of my questions. – hololeap Jul 2 '14 at 23:31
2

Converting my comment as an answer:

There has already been a lot of news on this point. Federal agencies do, in fact, ask for keys and get them.

2

Keep in mind that, even with the private key, if a site uses Perfect Forward Secrecy, it would take an active attack (MITM) to see traffic, and could only be seen after the key was acquired. Merely capturing data and analyzing later would be insufficient. Also, many of the large sites have multiple keys and rotate them frequently. If you look at encrypted.google.com, for example, you'll notice that the expiration date is less than 3 months after the issue date for the certificate.

So, while what you describe is possible, there are technological measures that can be employed to make it more difficult for governments to conduct this kind of dragnet surveillance.

  • That's good to know. I wondered if they rotated them frequently. Usually the expiration date on certificates is years in the future. – hololeap Jul 3 '14 at 6:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.