With SSLv3 you can prevent MITM attacks as well as replay attacks where the cert is compromised in the future. The SSL cert is used to verify the identity of th

With SSLv3 you can prevent MITM attacks as well as replay attacks where the cert is compromised in the future. The SSL cert is used to verify the identity of the server. Once the handshake is completed a symmetric key is chosen for the session using Diffie-Hellman key exchange (http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exch...) to compromise the session the NSA would have to subpoena the data from the servers memory (a real possibility) but would be unable to attack any sessions that had been previously recorded. This is called Perfect Forward Secrecy (http://en.wikipedia.org/wiki/Perfect_forward_secrecy http://en.wikipedia.org/wiki/Perfect_forward_secrecy). It is supported by OpenSSL using elliptic curve Diffie-Hellman. If this was adopted universally it would make conventional attacks on SSL impossible without compromising the servers memory. However there is still a risk that any government may compel a company to preserve the session keys under a gag order. If a CA is compromised then we have much larger problems since it is impossible to verify the identity of the participants in the session. Since an attack was used to create valid certificates as part of the attack on Iran's nuclear program it is likely that other attacks exist and are in the hands of the same actors. We can't move to ECC based SSL fast enough.