Guardian: "XKeyscore: NSA tool collects 'nearly everything a user does on the internet'"

[Xithras]

160. Technically it's not even required that the other party comply.

If the government intercepts your HTTPS traffic, they merely need to serve a warrant to the cert provider to obtain the keys for the SSL cert used by the site you connected to. Once they have the key, they can decode anything you sent. Facebook uses Verisign certificates. If the government wants to know what you're doing on Facebook, they don't need to get the data from Facebook, they can simply get the cert from Verisign and decode it themselves. In fact, I'd be pretty shocked if the NSA didn't already have the certs from most of the major sites like Facebook and Google on file just for that purpose.

It DOES prevent realtime snooping (because even with the key, the NSA doesn't have the computing power to decrypt every SSL connection in America in realtime), but SSL doesn't do much to protect your data if the government actually has some interest in your data for some reason (and conveniently, the "useless" metadata, which isn't protected by SSL, tells them exactly which certificates they need to use to decrypt everything).