Answer:
True - with SSL your traffic is being encrypted and cannot be understood or altered by a man in the middle attack or brute force unless the keys used are weak (which is not likely).
There are ways to fake connections (primarily by proxy servers) so that the user believes they have an SSL connection to a site but they really do not. The actual SSL connection is from the proxy server to the site, not the user to the site. The end result is that the proxy may be able to read the user's information.