HTTPS Basics

1

Let's Encrypt

HTTPS is becoming adopted by more and more websites every day. Modern browsers like Firefox and Chrome warn users if a website has an invalid certificate or if the connection is not secure (if it uses http:// instead of https://). They use a lock icon to the left of each URL to indicate if the site is authenticated and if it uses HTTPS. Latest versions of these browsers even ask twice before navigating to insecure sites. Tools like Firefox's built-in HTTPS-Only Mode and extensions like HTTPS Everywhere work by rewriting insecure HTTP request to HTTPS. And with services like Let's Encrypt, enabling HTTPS on sites is becoming more convenient.

#Identity And Access Management #Security & Privacy #Two Factor Authentication 310 social mentions

2

DuckDuckGo

In addition to protecting eavesdropping, HTTPS guarantees the request/response is delivered to the right recipient. It verifies the authenticity of all the entities involved in the process. For a website to be secured with HTTPS in a user's browser, it needs to provide a form of authentication to prove that it is the actual website that belongs to the actual server. To ensure this, it requires the server to install what is known as a certificate which is a unique cryptographic key and have it signed by an entity known as a certificate authority. The administrator of the website can ask the certificate authority to issue a certificate. In other words, a certificate is a way of saying if a browser is opened at https://duckduckgo.com, then it is really on the official site for DuckDuckGo.

#Search Engine #Web Search #Internet Search 1665 social mentions

3

DEV.to

Another drawback is that someone on the network can manipulate the requests, so they can insert ads, or inject code to serve phishing sites or just steal user information. In HTTP, if you visit a site, lets say, a shopping site, there is no way to actually verify that the site that you are visiting is the site you wanted to visit. In other words, the website you get if you wanted to go to http://dev.to, might not be the actual website. It can be a forged site injected by some entity along the network to trick users into giving away personal information. All these problems make plain HTTP a less ideal way to communicate on the web.

#CMS #Blogging #Blogging Platform 383 social mentions