Sebinsebzz

Https is not secure enough ?

•5 min read

In a recent intriguing case in Kerala, India, a leading news channel reported a unique instance where law enforcement successfully identified a criminal through IP address tracking. The accused, involved in a child abduction case, had shown a Tom and Jerry cartoon to the kidnapped child. Upon the child's rescue, authorities used the child's recollection of the cartoon to trace the specific video link. Although Google initially declined to cooperate, the cyber police were able to obtain the necessary details from the Internet Service Provider (ISP). This case highlights the critical role of digital footprints and the importance of understanding internet protocols like HTTPS in ensuring online security and aiding law enforcement.

The Significance of HTTPS

This situation raises important questions about privacy and data security, especially in the context of HTTPS (Hypertext Transfer Protocol Secure). HTTPS is the secure version of HTTP, which is the primary protocol used to send data between a web browser and a website. HTTPS is encrypted to increase the security of data transfer. This encryption makes it more challenging for unauthorized parties to intercept any data being transferred, including search terms and other sensitive information.

When a user searches for something on YouTube or any other website using HTTPS, the specific search terms they use are encrypted. This means that while any intermediary – such as an Internet Service Provider (ISP) or a potential attacker – can see that a connection is being made to YouTube, they cannot see the specific content of the search. They can only see the domain name (like youtube.com) and the fact that a connection is being made, not the specific path or query.

The Technical Challenge

In light of this, the claim that the police were able to obtain the exact search terms from the ISP seems technically questionable. Major companies like Google, which owns YouTube, have robust encryption protocols to protect user data, including search queries. Therefore, without direct access to YouTube's server logs or without cooperation from the company itself, it would be extremely difficult, if not impossible, for an external party to determine the exact search terms used by an individual.

Privacy, Data Security, and Law Enforcement

This case, therefore, brings to the forefront the ongoing debate around digital privacy, data security, and the capabilities of law enforcement in the digital age. It underscores the need for a clear understanding of how data encryption works and the legal frameworks governing access to digital information. While law enforcement agencies need certain capabilities to pursue criminal investigations, there is also a paramount need to safeguard individual privacy rights and data security in an increasingly digital world.

The Strengths of HTTPS

It's crucial to understand that ISPs, in a typical scenario, cannot view the contents of HTTPS-encrypted requests, such as the body of a request which might contain sensitive information like credit card details. This is due to several key features of HTTPS:

  1. Encryption for Confidentiality: HTTPS encrypts data during transmission, converting readable data into an undecipherable format using cryptographic keys. This process ensures that even if data is intercepted while it travels across the internet, it remains unreadable to anyone who does not have the corresponding decryption key. This encryption is what keeps sensitive information like credit card numbers safe when you shop online.

  2. Data Integrity Protection: Another critical aspect of HTTPS is its ability to protect the integrity of data. This means that the data sent or received is not altered, deleted, or tampered with during transmission. Data integrity checks are vital because they ensure that the information you send and receive is exactly as intended, without any unauthorized modifications.

  3. Authentication of Communication Parties: HTTPS also plays a crucial role in authenticating the legitimacy of websites. For instance, when you visit a website like Amazon, HTTPS helps verify that you are indeed on the correct website and not a fraudulent one designed to look similar. This is done through SSL/TLS certificates issued by trusted certificate authorities. These certificates serve as a stamp of approval, confirming that the website is legitimate and that your communication with it is secure.

Accessing Encrypted Data

The scenarios in which a government entity or an ISP can access the contents of an individual's HTTPS-encrypted requests are indeed limited. They typically involve either obtaining server logs directly from the service provider or having access to the encryption keys. In the context of the case in Kerala, where police claimed to have identified a suspect based on their YouTube search queries, the methods for obtaining such specific data are constrained by these technical boundaries.

Given the robust encryption provided by HTTPS, the most plausible ways for law enforcement to access an individual's search history would be through direct access to the user's device, such as examining the YouTube history on the accused's phone. Another method, albeit less likely given the article's denial of such cooperation, would be obtaining server logs from the service provider. However, this would typically require legal procedures and the willingness of the provider to comply.

Balancing Privacy and Law Enforcement

In conclusion, this case underscores the complexities and challenges that arise in the intersection of technology, privacy, and law enforcement. While the capabilities of HTTPS in protecting user data are formidable, they also present hurdles for legal investigations. This situation highlights the ongoing need for a balanced approach that respects individual privacy and data security while providing law enforcement with the tools necessary for effective and lawful investigations. As technology continues to evolve, so too must our understanding and frameworks for managing these critical and often competing priorities.

Connect with Me