Introduction to HTTPS
How HTTPS Actually Protects You — And When It Doesn't
The padlock icon is real security. But it isn't the whole picture — not even close.
You've probably heard "always use HTTPS" a thousand times. But what is it actually doing? What exactly gets protected? And if HTTPS is so secure, why do people still get hacked on HTTPS websites? Let me show you the full picture.
HTTP vs HTTPS — the core difference
HTTP sends your data as plain text. If someone intercepts your request on an HTTP page — say, on a café Wi-Fi — they can read everything: your username, your password, what you searched for. It's like sending a postcard. Anyone who handles it along the way can read it.
HTTPS is HTTP with TLS (Transport Layer Security) layered on top. TLS encrypts your data before it leaves your device. Even if someone intercepts it, they see scrambled, unreadable nonsense. It's the same message, but now in a sealed, tamper-proof envelope that only the destination server can open.
What happens during a TLS handshake
Before any actual data is exchanged, your browser and the server do a quick negotiation called a handshake. Here's what happens in roughly 200 milliseconds when you visit an HTTPS site:
- ClientHello: Your browser says "I want a secure connection. Here are the encryption methods I support."
- ServerHello + Certificate: The server picks an encryption method, and sends its digital certificate — a document signed by a trusted Certificate Authority (CA) proving the server is who it claims to be.
- Certificate verification: Your browser checks — is this certificate from a CA I trust? Is it still valid? Does the domain match?
- Session key exchange: Both sides agree on a shared secret "session key" without ever transmitting it over the network (using a clever asymmetric cryptography technique).
- Encrypted communication begins. Every byte of data from here on is encrypted using that session key.
What the padlock actually means
When you see the padlock, it tells you three things about your connection:
- Confidentiality: Data is encrypted in transit — nobody intercepting the traffic can read it
- Integrity: The data has not been modified between sender and receiver
- Authentication: The server you're talking to is verified by a trusted Certificate Authority — it's actually that bank's server, not an impersonator
🔍 See it yourself Click the padlock on any HTTPS site → "Connection is secure" → "Certificate is valid." You'll see the issuer (the CA), the validity dates, and the domain it covers. This is the chain of trust in action.
When HTTPS does NOT protect you
This is where most explanations stop — and they shouldn't. HTTPS only secures data in transit. It says nothing about what happens to your data once it arrives at the server.
Phishing sites with valid certificates
Getting a free TLS certificate from Let's Encrypt takes 30 seconds. An attacker can register secure-mybank-login.com, get a valid HTTPS certificate, and the site will show a padlock. The connection is genuinely encrypted — you're just securely sending your credentials directly to a criminal. The padlock means the connection is secure, not that the site is trustworthy.
Data breaches at the server
Your data arrives encrypted, then gets decrypted at the server. Once it's stored in a database, it's no longer "in transit" — HTTPS provided no protection. If the server's database is breached, your data is exposed regardless of the padlock you saw.
SSL stripping attacks
If you navigate to a site by typing just the domain (without https://), your browser sends the first request as plain HTTP. A MITM attacker on your network can intercept that initial request and serve you an HTTP version of the page — stripping away the upgrade to HTTPS. Defence: browser-enforced HSTS (HTTP Strict Transport Security) prevents this by telling browsers to always use HTTPS for that domain.
Quick summary — what HTTPS does and doesn't do
- ✅ Encrypts data between your browser and the server
- ✅ Verifies you're talking to the right server
- ✅ Prevents eavesdropping on public Wi-Fi
- ❌ Does not mean the website is safe or legitimate
- ❌ Does not protect your data once it's stored on the server
- ❌ Does not protect against phishing
What to explore next:
- Computerphile: TLS handshake (YouTube)
- SSL Labs: test any site's TLS config
- Next post: I Scanned My Own Network — Here's What I Found →
