Most web addresses these days start with HTTPS,
which implies that your connection to the website is secure in some way, that's what the S stands for.
But what exactly is HTTPS, and how safe is it really keeping you?
HTTPS is a protocol that encrypts information sent over the internet, specifically the content
that's traveling between your PC or phone and the server for the website you're viewing.
Without HTTPS, any of that content, such as private messages, payment info,
or the videos you're watching, could be intercepted by an attacker or snoop,
such as someone with a packet sniffing program connected to the same Wi-Fi network
or by an IT administrator monitoring traffic at your office.
Although most websites these days use HTTPS,
this wasn't always the case, but why? Well, it had to do with how security certificates worked.
That's the electronic document used to generate the HTTPS encryption.
Not only does it contain a public key, but it also enables another important function of HTTPS.
It lets a user know the site that they're accessing is indeed what the URL says it is.
Although anyone can make a certificate, it needs to be signed by an organization
called a certificate authority in order for your browser to recognize it as valid
and give you that nice little padlock icon up in the corner, it makes me feel so nice.
For a certificate authority to sign a certificate, the website owner needs to show that they actually control
the domain name on the certificate. Without a certificate authority signature,
the encryption will still technically work if the certificate owner self signs it,
but the issue is that you, the user at home,
won't know who's on the other end of the connection. It could very well be an attacker ready to steal your data.
The problem for a long time was that certificate authorities charged money for this service up to several hundred dollars
a year, which many site owners just didn't wanna bother with,
especially if they were running smaller websites. But nowadays, it's easy to get certificate signed for free
in large part due to a nonprofit authority called Let's Encrypt, backed by the electronic frontier
foundation as well as several large tech companies. And there's the fact that Chrome started displaying
aggressive looking warnings whenever you visited a site without a certificate signed by a recognized authority,
that got HTTPS adopted role in a bit quicker.
But do keep in mind, you won't see this warning if a site doesn't use HTTPS at all.
So be sure to glance up at the address bar to see if the site is just using plain HTTP.
Also keep in mind that there are ways your employer could still look at your web traffic,
such as through a proxy and putting a custom certificate
authority on your PC. But I'm sure all of you are on your best behavior
on the job. One common misconception is that the HTTPS padlock
means that you're connected to a site that you can trust with your personal information.
This is definitely not the case. There are plenty of phishing sites whose appearance
imitates the legitimate site, but you often can see up in the address bar
that the URL doesn't match the site that you want, so their certificates get signed
because the attackers do own that URL. They aren't trying to get a certificate for the real site,
so look at the URL very closely if you suspect you're the target of a phishing attack.
If you wanna be really careful, check the certificate too.
As another kind of attack called DNS poisoning
can even return a malicious website with a legitimate looking URL.
Here's another important thing to remember. Although HTTPS does technically encrypt
the URL of the webpage you're viewing, the domain and subdomain of the website you're visiting
are still visible if you're using standard unencrypted DNS,
the system that looks up the numerical IP addresses of the domain names that you punch in.
This means that an attacker can look at your DNS query
to figure out what site you're visiting, though not which specific page.
Additionally, even if you're using HTTPS, domain names are initially sent
unencrypted plain text to the server you're trying to access
because of the way TLS works. This is the cryptographic protocol HTTPS uses
to handle encryption. In this first step of the TLS handshake,
the server looks at the plain text domain name to figure out which subdomain the user wants.
Think for example of the two letters before wikipedia.org
that indicate which language you're viewing the site in. The connection is only encrypted after this happens,
making it a fairly significant privacy concern. Although the newest version of TLS has a feature called
ECH meant to plug this hole, it's not yet widespread across the web.
Hopefully we'll see adoption increase over the years, along with that of encrypted DNS.
Neither are perfect silver bullet privacy solutions,
but if that existed, someone out there would probably have a fortune
that would put even daddy Bezos to shame. But whatever the opposite of shame is,
I'm giving to you right now for watching the whole video.
Hey, thanks, like it if you liked it, dislike it if you disliked it,
check out our other videos, comment below with video suggestions, and don't forget to subscribe and follow.
Okay.