HTTPS

Hypertext Transfer Protocol Secure, known as HTTPS, is a security extension of the standard Hypertext Transfer Protocol (HTTP). While HTTP allows for the transfer of data across the internet, it does not provide protection against outside interference. HTTPS solves this by adding an encryption layer to the communication process. This protocol is essential for maintaining the privacy and integrity of data while it travels over a network. It ensures that the information sent between a user and a website remains secret and unchanged. By using HTTPS, the internet becomes a much more reliable place for sensitive activities like banking or private messaging.

The mechanism of HTTPS relies on a process called encryption to create a secure channel. This is achieved through a protocol known as Transport Layer Security, or TLS. In the past, a similar system called Secure Sockets Layer (SSL) was used. When a client, such as a web browser, connects to a server, they use these protocols to encrypt the data flow. The system typically uses long-term public and private keys to generate a short-term session key. This session key is then used to encrypt the actual data being exchanged. This bidirectional block cipher encryption protects the communication from being read by eavesdroppers or altered by unauthorized parties.

One of the most important parts of this process is authentication. To prove a website is legitimate, it must present a digital certificate. These certificates are signed by a trusted third party called a certificate authority. The certificate authority acts as a digital notary to vouch for the identity of the server. When you visit a site, your browser checks this certificate against a list of trusted authorities pre-installed in its software. This helps prevent man-in-the-middle attacks, where an attacker tries to impersonate a website or intercept the connection. If the certificate is invalid or does not match the website, the browser will display a warning to the user.

Historically, the use of HTTPS was limited to specific types of websites. Because obtaining signed digital certificates was an expensive operation, only large corporations or secure payment services used it. However, the landscape changed significantly due to organized advocacy. In 2016, the Electronic Frontier Foundation (EFF) launched a campaign to make HTTPS more common. They worked alongside web browser developers to encourage widespread adoption. This movement helped transition the web from a mostly unencrypted environment to one where security is the standard. Since 2018, HTTPS has been used more often by web users than the non-secure HTTP.

Recent data shows how quickly the internet has become more secure. In December 2022, approximately 58.4% of the 150,000 most popular websites used HTTPS. By the time of recent reporting, that number had risen to 71.2%. Additionally, Firefox Telemetry data indicates that 70% of all page loads now use HTTPS. While the newer TLS 1.3 protocol was released in 2018, many servers still use the older TLS 1.2 version. Despite these variations, the shift toward encryption is massive. This widespread use is vital for protecting users from mass surveillance and data theft.

There are specific technical limits to what HTTPS can hide. While it encrypts the entire HTTP protocol—including the URL, query parameters, headers, and cookies—it cannot hide everything. Because website addresses and port numbers are part of the underlying TCP/IP protocols, they remain visible. An eavesdropper can still see the IP address of the server and sometimes the domain name. They can also see how much data is being transferred and how long the connection lasts. However, the actual content of the communication, such as your passwords or messages, remains encrypted and unreadable.

Understanding HTTPS is also important when using insecure networks, such as public Wi-Fi. On these networks, anyone can use tools to "packet-sniff" and discover sensitive information if it is not protected. Some networks have even been known to perform packet injection to add advertisements to webpages. This can be used maliciously to inject malware into a user's device. For users of the Tor network, HTTPS is especially critical because malicious Tor nodes could otherwise alter the content passing through them. By using HTTPS, users can maintain their privacy and security regardless of the connection they are using.