HTTPS?
Hypertext Transfer Protocol Secure (HTTPS) is the secure version of HTTP, the primary protocol used to send data between a web browser and a website. HTTPS is encrypted in order to increase the security of data transfer. This is especially important when users transmit sensitive data, such as logging into a bank account, email service, or health insurance provider.
Also:
Any website, especially those that require login credentials, should use HTTPS. In modern web browsers such as Chrome, websites that do not use HTTPS are marked differently from those that do. Look for a padlock in the URL bar to indicate that the web page is secure. Web browsers take HTTPS seriously. Google Chrome and other browsers flag all websites that do not use HTTPS as not secure.
not-secure
How does HTTPS work?
HTTPS uses an encryption protocol to encrypt communications. The protocol is called Transport Layer Security (TLS), although it was formerly known as Secure Sockets Layer (SSL). This protocol secures communications using what is known as an asymmetric public key infrastructure. This type of security system uses two different keys to encrypt communications between two parties:
- The private key – This key is controlled by the owner of a website and kept, as the reader might expect, private. This key lives on a web server and is used to decrypt information encrypted by the public key.
- The public key – This key is available to everyone who wants to interact with the server in a way that is secure. Information that is encrypted by the public key can only be decrypted by the private key.
Why is HTTPS important? What happens if a website does not have HTTPS?
HTTPS prevents websites from broadcasting their information in a way that is easily viewable by anyone snooping on the network. When information is sent over regular HTTP protocol, the information is broken into data packets that can easily be “sniffed” using free software. This makes communication over an unsecured medium, such as public Wi-Fi, highly susceptible to interception. In fact, all communications that occur over HTTP occur in plain text, making them fully accessible to anyone with the right tools, and vulnerable to on-path attacks.
With HTTPS, traffic is encrypted such that even if the packets are sniffed or otherwise intercepted, they will come across as nonsensical characters. Let's take a look at an example:
Before encryption:
This is a string of text that is completely readable
After encryption:
ITM0IRyiEhVpa6VnKyExMiEgNveroyWBPlgGyfkflYjDaaFf/Kn3bo3OfghBPDWo6AfSHlNtL8N7ITEwIXc1gU5X73xMsJormzzXlwOyrCs+9XCPk63Y+z0=
On websites without HTTPS, Internet Service Providers (ISPs) or other intermediaries can inject content into web pages without the consent of the website owner. This typically takes the form of advertising, where an ISP looking to increase revenue injects paid advertisements into their customers' web pages. Unsurprisingly, when this happens, the advertising revenue is not shared with nor are those ads quality-monitored by the website owner in any way. HTTPS eliminates the ability of unregulated third parties to inject advertising into web content.
