HTTPS, which stands for Hypertext Transfer Protocol Secure, is recognized as a very secure way to access webpages. Online payment, banks, VPN services and email sites, are examples of websites that require the high level of security that HTTPS offers. All that being said, it’s not flawless.
There are certain aspects in the way HTTPS works which make it vulnerable to infiltration and monitoring from government organizations like the NSA. We will examine the concerns around HTTPS, as well as the way in which PFS can address these issues.
HTTPS
HTTPS (wiki) is built on top of SSL and TLS protocols, which are supported by all modern browsers. It adds the encryption capabilities of SSL/TLS to standard HTTP, with the aim of preventing eavesdropping. You will notice that when you visit a secure website, a padlock appears on the taskbar to show that you are using an encrypted connection to access the site.
In order to work, the system requires that your computer and the server establish an agreement to shared an encryption key. This shared encryption key is different for every computer that connects to the server and changes every time the computer does so. Shared encryption keys are sent to the server using its public encryption key, which is decrypted using the server’s private encryption key.
The issue is that once someone gets the private encryption key, they could be able to access all the data protected by keys derived from it. Worryingly, many companies have opted for using only one private encryption key. While it’s an easy solution, if this key is not secure, all communications are at risk of being decrypted. All it takes for an attacker to obtain full access to company data is that the private encryption key is compromised.
NSA Surveillance Implications
Nobody is safe from being targeted by the NSA surveillance program, as the organization continues monitoring internet communications. The information leaked by Edward Snowden on NSA operations indicates that the majority of data is briefly reviewed and if nothing of interest is found, it is not kept. Data from users in the United States has to be discarded and even though the same regulations do not apply to other jurisdictions, it is likely that data originated in other countries is also disposed of.
On the other hand, if the data is encrypted, the organization keeps it for an indefinite period of time, while decryption is attempted. The implications for the use of private encryption keys and the way the NSA handles data are that if the organization manages to get the private encryption key of an email provider like Hotmail, it would be able to decrypt every email sent through their service. The NSA stores encrypted information until it can be cracked and the fact that HTTPS works using a single key that could unlock everything, means that once the organization finds this key, it could get access to all the data stored.
PFS – Perfect Forward Secrecy
Perfect Forward Secrecy or simply PFS (wiki), is a system that uses a new and unique encryption key for every session. This means that there is no single or “master” key, as every HTTPS session has its own set of keys. PFS would be the solution to address HTTPS vulnerabilities and the risk of retrospective decryption, but the issue is that it isn’t widely implemented,. The only giant tech company that has adopted it is Google and has campaigned for the expansion of Perfect Forward Secrecy, which it uses by default.
Additionally, Google allows users to verify if PFS is in place while browsing the internet with Chrome. You can click on the HTTPS padlock icon and select Connection tab to find if a website is using PFS. If the key exchange mechanism is ECDHE_RSA or DHE_RSA, this means that PFS is being used. It is important to bear in mind that while only Chrome offers information to verify if PFS is being used, this system also works with the latest versions of Firefox and Internet Explorer.
A Bit More Info
There are different reasons as to why PFS is not widely used, in spite of the security advantages it offers.
In some cases, it simply comes down to a lack of knowledge about PFS. Of course, that isn’t an excuse for major companies that are expected to be on top of security measures. Unfortunately, Google is the only big name that has implemented it. The fact that other players in the industry are not using PFS has prompted some analysts to suggest that this is because they want to give the NSA, GCHQ and other similar organizations, easier access to data.
A while ago, this may have seemed overly paranoid but now that we are aware of the intensity of surveillance programs, it is not hard to believe that large companies willingly compromise the security of their users in collaboration with these government organizations. However, it is also worth considering that PFS requires more processing power, which could also be a major factor explaining why the majority of companies have not rushed to adopt this technology.
Conclusion
Although HTTPS is meant to add security to a website connection, the way it usually works could actually make data easier to compromise. The NSA stores encrypted information until it is able to unlock it. The fact that HTTPS uses a “master key” could facilitate the decryption process. Once that key is discovered, all the data can be easily accessed.
PFS could fix this issue by making every HTTPS session secure thanks to the use of new and unique encryption keys each time. While the delay of most companies to adapt PFS is concerning and raises questions about their commitment to security, it is expected that with Google involved, other big names will follow. More information regarding similar encryption tools and apps can be found on our online privacy guide.