2

In various news sources I read often that Google search terms are mass intercepted and tracked. I wonder how is this even technically possible when communication between PC/phone to Google is encrypted by default with HTTPS aka SSL aka TLS? Everytime I read such a claim I cannot believe it is true because this usually needs a non technical solution like a court which says to Google: "Give us the search terms of this user"

Recent example:
https://theintercept.com/2015/09/25/gchq-radio-porn-spies-track-web-users-online-identities/

therealmarv
  • 425
  • 1
  • 5
  • 7

1 Answers1

2

For the average webmaster, having Google switch to TLS has made tracking somewhat more difficult. The problem of course lies in that the referral connection was encrypted and so you can no longer just 'see' it as was the case years ago. That being said, tracking in not impossible. For instance the average webmaster can use services that essentially embed tracking cookies on many subscribed sites (Google themselves do this). Google only gives you analytic data to your site but it still collects all of this data (we will touch on that later).

Hypothetically, you could also create your own tracker that simply embeds a bit of code on every website that stores the user's info -however, this is obviously infeasible and also not needed (although Google and others do try)!

If you are a law enforcement agency, intelligence agency (GCHQ), or hacker, you potentially have access to the conduit that all of this traffic flows through (via court orders or exploits) and what's more is that you likely have access to the TLS certificates themselves (via court orders or exploits as well).

Obviously, there are legal and moral issues surrounding all of this but the technical rationale for how traffic can be monitored is sound. In regards to your GCHQ example (I didnt follow the link because I am at work and it contains the word 'porn' -can't have them tracking me now), the agency most likely had a subpena to access the information (if they 'hacked' the info, it would be poor OPSEC to disclose such a feat). Considering that the top 5 CAs are based in either the UK or US, this is not much of a stretch to assume. For example From a ToS at section 8.3:

Comodo will disclose information where required by a subpoena, interception order or other lawful process.

If anyone can add some examples and references, that would be great. I tried to make this more than just conjecture but we will see how it is received.

Matthew Peters
  • 3,622
  • 4
  • 21
  • 39
  • thanks for detailed answer. So in short: If they have the root CA (whoever knows if they have) they can intercept. So we all are in the dark if this is the case :/ – therealmarv Sep 25 '15 at 13:46
  • @therealmarv, It's really all about encryption. The CA issues the key pair and thus knows how to decrypt what you are sending. It's a complicated chain but it could be unraveled with enough resources (IE subpenas). There are ways to mitigate this though; the easiest is to simply use a VPN for all traffic. You can additionally use an anonymous browser such as Tor. – Matthew Peters Sep 28 '15 at 12:08
  • 2
    **No, they can't** I'm sure Google doesn't let the CA create the private key for them. The CA could sign another key saying that it belongs to Google (while it's owned by someone else). But it would be detectable. Applications pinning certs would fail / report it (beginning by Google Chrome). Any CA that was found to do so would be highly scrutinized, and risked getting removed from the browsers (and by signing it it's possible to later prove their misdeavor). And if you were an intelligency agency that got access to a CA key, you would use it very scarcely. – Ángel Oct 08 '15 at 22:46