Its 2013. Were all being spied on. Why do security software websites not use HTTPS?

"People say that using HTTPS is a performance hit. Locking your car door is also a performance hit, and so is putting on clothes in the morning. Security and privacy is worth a performance hit"

Warning, incoming gi-fucking-gantic wall of text. Read it anyway. Allow me to ELI5 what people seem to not be getting about all of this, and hopefully clear up some FUD (fear, uncertainty, and doubt). ...

Warning, incoming gi-fucking-gantic wall of text. Read it anyway. Allow me to ELI5 what people seem to not be getting about all of this, and hopefully clear up some FUD (fear, uncertainty, and doubt). --- Imagine you have two really big numbers called keys, and they're mathematically linked. One is called a public key, and the other is called a private key. Now imagine you have two algorithms, functions, sets of instructions for those two keys. One, is the encryption/signing algorithm, hereafter ES. The other is the decryption/verification algorithm, hereafter DV. If you send data through ES with a public key, it becomes encrypted, and no one (not even the NSA, assuming the numbers are big enough) can read it. Seriously. If you send data through ES with a private key, it becomes signed, proving that you (or the person controlling the private key) verified its accuracy. If you send encrypted data through DV with a private key, you decrypt it back into legible plaintext. If you send a signature through DV with a public key, it proves that the owner of the private key signed it. --- Now, suppose a person named Clara takes Steve's public key, she can use ES to encrypt data so only he can decrypt it (using DV). Then, she can send said encrypted data through insecure mediums like her gossipy aunt Irene. All Irene knows is that encrypted gibberish is passing between them, not what the contents are. Now here's the ploy, Clara's "friend" Eve wants to know what Clara's saying to Steve. She sets up a simple trick: She'll stand in the middle. She'll tell Clara (via Irene, who believes her to be Steve (false ID or something, I don't know how for this analogy)) that Steve's public key has changed, or perhaps some other kind of trickery that makes Clara accept the new key. The catch here is that it hasn't actually changed. Eve's made her own, and she tells Clara the new one, and then Clara starts using that new one. Clara sends messages encrypted using Eve's public key to Eve who takes these messages, runs DV, and then ES using Steve's real public key, and sends them on to him. The whole while, Clara still thinks she's talking to Steve directly, and Steve thinks he's getting messages from Clara directly, and they have no way to verify otherwise. Now lets imagine Clara and Steve are smart, and knew this might happen. They ask their friend Andrew to help out. He makes his own set of keys, gives his public one to Clara, and the following goes down. Clara asks Steve for his public key. Steve had, the other day, sent it to Andrew, who signed it with ES, verifying Steve's control/ownership. Steve sends it and the signature to Clara, who uses DV and Andrew's public key to verify that Steve actually has that key, because Andrew's private key signed it. Andrew is a trusted third party, saying that yes, that public key belongs to Steve. Now, if Eve wants to be a woMan in the Middle (MITM), she has to get Andrew to sign her key, but Andrew is loyal and won't do that. Unfortunately, Eve has some dirt on Andrew: He's been sleeping around/stealing/doing something illegal or immoral! If word of that got out he'd be doomed. So what's he do? He signs Eve's public key OR gives her his private key. The same as above happens, Eve is in the middle, Clara and Steve are none the wiser. If, by any chance, you got this far after that mess, here's the key:

Cl ara and S teve are the Cl ient and the S erver. I rene is the I nternet, insecure and compromised, every byte travelling its wires and networks overheard. Eve is the E a ve sdropper, the NSA. A ndrew is the Certificate A uthority, trusted, but probably compromised. It really is that simple. If the NSA has the Certificate Authorities private key, they can make fake certificates (public keys) and sign them (ES) all day long, send them all around, and no one would be any bit the wiser. It's a trust system, assuming that Andrew is not compromised. If he is (he almost certainly is) and they bothered to run some simple software that runs on hardware as simple as that in mobile phones

(meaning it's easy stuff, you don't need supercomputers to do it and if you happen to have supercomputers on hand, this is just a trivial, spare dealio to run in the background) then you can bet your ass all of HTTPS is compromised and is totally useless. EDIT: Confirmed, it's happened once. No reason to believe that it won't or can't or hasn't happened again behind closed doors with others. I'm not joking. Any questions, comments? Did I miss something important? --- EDIT: this is assuming a targeted attack. If you're only under passive surveillance you're probably fine. The moment you go on a list though, and you become watched... consider your security gone. TL;DR Clara and Steve think they're talking to each other but it's actually Eve, and Andrew's probably being blackmailed. Also read it. E38EB6FB, keys.gnupg.net

Tags:
q

article