How safe is HTTPS? [closed]

Question

It may be a lame question but still bothering me since long time. I have come across many web sites which are using HTTPS recently and they mention that all the financial transactions on their site are safe.

Is it really safe or are there any loop holes still there for the [dark] hackers to invade our privacy? If you can add up some points on how safe it is, it would be great knowledge for me and others.

Answer 1

https itself is safe* but https is only responsible for the transfer of data between you and the server. What happens once the data data reach the server is not covered by https. So if someone hack the server, and gain access to its database your data may still be lost.

So the conclusion is that: Yes https is a safe way to transfer data between you and a server, but most security problems happens after the transfer itself.

*Safe as in: Not even the best crypto experts have been able to break it, but it have not been 100% proven that it is safe.

Ok, I better clarify the safety bit. When talking about https there really are 2 different things which need to be safe, in order for the system to be safe.

a: The specification - This is the description of the math used to do the encryption. This part uses standard encryption algorithms and these are in general considered safe. To break the math behind the encryption you will among other things have to find a fast method to factor prime factors. This method in itself will give you a 1 million $ math price if you solve it. So the math part is rather safe.

b: The implementation - This is the code in the browser which implement the math mentioned in part a: This is the part which is most likely to give security problems, because it is very difficult to prove that the code is a correct implementation of the math in the https specification. And there have in the past been implementations which were incorrect and thus caused security problems. Most known is the bug in netscape 4 where they made a mistake so only 56 of the 128 bit in the encryption key were really random. But you should be pretty safe here, if you just upgrade your browser when new security upgrades become available.

But even if there were a security problem with https, a hacker would still need to be able to read the data between you and the server in order use this security hole. Something which is rather difficult, and normally require that he hacks a system which is located between you and the server.

Or you can just look at the history: In the entire history of the internet, information of millions of credit cards have been leaked. But in none of these cases have a security problem in https been used to gain access(I have at least never seen or heard about any such case, and google could not find any).

So when you make a list of possible security problems with internet trade, a bug in ssl is very very far down the list of things you need to worry about.

(And I am talking about the modern 128bit ssl. The older versions(56 and 64 bit) are not safe anymore due to increased cpu performance).