It does matter and the article has reasoning about why it does. "The NSA could get the DuckDuckGo master cert in one of three ways:

1. Be given the cert

2. Physical access to servers or load-balancers

3. Remote access to servers or load-balancers"

If they can get direct access to the DDG servers, then it doesn't matter if they can siphon off traffic at the ISP level. They can just access the data.

But wouldn't that require constant access to the server, whereas the key they could steal once with short access to server and use until it expires without the victim noticing?

My understanding is that if they're using Perfect Forward Security it doesn't matter, because unless you're modifying the traffic in flow (which is much harder to do secretly) then it doesn't matter if someone-else has the private key, they won't be able to decrypt the data in any case.

How do you expect to get the nonce across the network without the NSA getting it?

I'm no expert in PFS in TLS, but there are various key-agreement protocols that allows parties to establish a secure key over an insecure channel.

I believe the way PFS works is that it uses RSA to verify identity and then Diffie-Hellman to establish keys.

If you're only able to passively intercept data (i.e. you can't impersonate the server and MITM) then you're unable to discover what the key established by DH is.

(incidentally nonces are generally only relevant for preventing replay attacks; the nonce doesn't play a part in passive defence)

> I believe the way PFS works is that it uses RSA to verify identity and then Diffie-Hellman to establish keys.

It's the other way around. First you do the DH and then use RSA to authenticate (a hash of) DH parameters.

This article may help explain how: http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se...

Well the point raised by the article is that HTTPS doesn't matter much if the certificate is compromised.

Is this true even with perfect forward secrecy, as is used on DDG?

Https doesn't have to terminate at the server doing the work. A feed splitter could be put between the https termination and the engine room. If ddg were compelled to do this, it's entirely possible to do so without giving up the cert.

How unreasonable is it that DDG could have their private key taken by the NSA?

I expect the NSA does this as a matter of course, at least for large enough companies.