I found some posts on this forum that explained that https settings are possible to crack. see here. Why is it possible to sniff an HTTPS / SSL request?
And here is another post that mentions redirecting trusted certificates so as to fool the victim that they are connecting to the right people.
If these claims are true, what is the best way for us to keep our browsing private? I use Tor and used to have JonDo before it got corrupted.