What does the padlock in your browser actually mean?
The padlock never promised that a website is honest. It only promised that your line to it is private.
Guess first
?
Which one is it?
The padlock means one thing: the connection between your browser and the website is private, and the site showed a certificate with the name you asked for. It does not mean the site is honest. HTTPS is ordinary web traffic carried inside a protocol called TLS, and the main aims are to confirm which website you reached and to keep the data private and untampered with while it travels.
Here is how that works in a blink. Your browser opens a connection and the server answers by showing a : an ID card holding the site's name, the name of the that vouches for it, and the site's . Your browser checks the card, and the two sides use a public-key trick to agree on a secret key that only they know; from then on everything is scrambled with that shared key. If any step fails, the connection is simply not created, which is why you sometimes see a full-page warning instead of the site.
Step 1: Browser says hello
It asks for a secure connection
Step 2: Server shows its certificate
Name, who vouches for it,
Step 3: Browser checks the card
If a step fails, no connection
Step 4: Both agree a secret key
Using public-key cryptography
Step 5: Everything is scrambled
With the shared key until the end
So a thief on the same cafe Wi-Fi sees only gibberish, and cannot easily slip in a fake copy of the site, because the fake would have no valid certificate for that name.
The catch is the part people forget. The lock is about the line, not the people at the other end. Many users believe a lock icon implies a website is safe; Chrome, for its part, replaced its padlock with a 'tune' icon from version 117. A scam site can have a perfectly valid lock too: it just proves that you really are talking to that scam site, privately.
Quiz me
0/3
Recap
The padlock proves your line to a named site is private, not that the site is honest.
π‘ A trick to remember it Β· A padlock is a sealed envelope, not a character reference: it guards the letter on its way, whoever wrote it.
Surprising fact Β· SSL was renamed TLS partly as a face-saving gesture to Microsoft, according to one of its authors.
Connects to
- π How did one bug put much of the internet at risk, from Heartbleed to Log4Shell?
- π How does your browser find a website from just its name?
- π How does your browser know that the padlock is not a fake?
- π£ Why does one convincing email fool even careful people?
- π How can two strangers agree on a secret while everyone is listening?
Sources (2)
No source, no claim. Every fact in this lesson (15 claims) cites at least one of these.