Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The UK government is trying to implement man-in-the-middle attack systems in order to capture header data in all packets. They are also equipping the "black boxes" they will use with technology to see encrypted data (see the Communications Data Bill).

I use a VPN to increase my privacy. It uses OpenVPN, which in turn uses the OpenSSL libraries for encrypting data. Will the government be able to see all the data going through the VPN connection?

Note: the VPN server is located in Sweden, if that makes a difference.

share|improve this question

The Communications Data Bill requires service providers to keep logs. It doesn't provide for decryption of data content.

I imagine GCHQ and the SIS have ways of circumventing your VPN security if they so wish (though they may need a court order to stay within the law - RIPA etc).

share|improve this answer

If you assume that they do not have the capacity to break your ciphers (by default, blowfish and RSA), that your own systems are not compromised, and that the software you use is not backdoored, they could only attack your link by tricking you into accepting a fake certificate.

You can avoid that either by using a static key (but that creates its own set of key distribution problems), or make sure they cannot obtain a fake certificate. If you rely on some CA, you must make sure the CA will not issue fake certificates, or bypass the CA and anchor your trust directly to the certificates you know.

You should also make sure your certificates use a robust hash function (sha256 at least), because if the CA allows third parties to request certificates, a third party could try to create a pair of colliding certificates, one legitimate and one spoofing your identity, and transplant the signature from one cert to another.

You still need to be careful with your key lengths. In particular, 1024bits is no longer recommended for RSA

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .