Why the Web Needs Perfect Forward Secrecy More Than Ever

most HTTPS websites on the Internet still don’t support forward secrecy, which means that a large chunk of your past communications with those servers is vulnerable to decryption when private SSL keys are compromised. For example, if someone has been intercepting your HTTPS-encrypted messages to Yahoo for the past several years and then stole a copy of Yahoo’s private key yesterday with Heartbleed, they would be able to use it to go back and decrypt the previously-unintelligible recording of your old communications today — if those communications weren’t made using a forward-secrecy-enabled connection.

In the aftermath of yesterday’s events, it’s clear that forward secrecy is necessary to protect against unforseeable threats to SSL private keys. Whether that threat is an existing or future software bug, an insider who steals the key, a secret government demand to enable surveillance, or a new cryptographic breakthrough, the beauty of forward secrecy is that the privacy of today’s sessions doesn’t depend on keeping information secret tomorrow.

It’s time the internet starts to embrace the importance of security the same way it did design the last ten years.