HTTPS allows a client to safely share sensitive information with a server through an HTTP request. HTTPS is critically important when it comes to sending sensitive data such as credit card information, passwords, or bank account numbers.
🔗 How does HTTPs work? (video)
Subscribe to my YouTube channel if this video was helpful!
🔗 Too long, didn’t watch
In short, HTTPS works like this:
- The client contacts the server and requests a secure connection
- The server sends the client its public key
- The client and the server use asymmetric encryption (like RSA) to negotiate a shared private key
- The shared private key is used by the client to encrypt the HTTP request (using symmetric encryption like AES)
- The server uses the shared private key to decrypt the HTTP request
- The server uses the shared private key to send the client an encrypted response
- The client uses the shared private key to decrypt the response
🔗 HTTPS is just HTTP with extra security
🔗 When should I use HTTPs?
While HTTPS is only critically important when it comes to sensitive data, it’s a good idea to just use HTTPS for all of your web traffic. If you browse a website that doesn’t use HTTPS, your browser will actually give you an ugly little warning to let you know that the site is not as secure as it should be.
If you develop websites, use HTTPS.
🔗 Careful! HTTPS is not necessarily private
Just because a website uses HTTPS doesn’t mean that your communication with them is private.
🔗 HTTPS keeps your messages private, but not your identity
It’s important to note that while HTTPS encrypts what you are saying, it doesn’t necessarily protect who you are. Tools like VPNs (virtual private networks) are needed for remaining anonymous online.
If you use a VPN, the company that runs the VPN is responsible for keeping your identity private. There is another option for privacy called a TOR network, which is a network of computers that are all connected. The TOR network, which you can use via a Tor browser, is designed to keep your identity anonymous, but it effectively adds another layer of privacy. You can use a VPN and a Tor browser if you’re really concerned about your privacy.
In short, HTTPS keeps your messages private, but not your identity or the identity of the server you’re communicating with. VPNs and TOR networks can help with that.
🔗 HTTPS ensures that you’re talking to the right person (or server)
In addition to encrypting the information within a request, HTTPS uses digital signatures to prove that you’re communicating with the server that you think you are. If a hacker were to intercept an HTTPS request by tapping into a network cable, they wouldn’t be able to successfully pretend they are your bank’s web server.