cognoscJoin the beta

How does HTTPS work?

How can a site keep a secret from everyone on the line? Guess first, then try key exchange with real numbers and see what a certificate proves.

The steps5 · 28 min
  1. 1Plain HTTP can be read and changed by everyone on the way5 min
  2. 2Only the key is secret, and a long key can't be guessed5 min
  3. 3Two strangers can agree a secret in public7 min
  4. 4A certificate shows who you've agreed the secret with7 min
  5. 5HTTPS hides the content, not the destination5 min
Free, no card
What it takes apart

Sound like you?

The ideas people most often get wrong on the way, in their own words. Each step starts from one of them.

“When I send something to a website it goes straight from my device to the site, so only the site can see it.”Taken apart in step 1Thinking your data goes straight to the site“Encryption is safe because nobody knows how the scrambling works.”Taken apart in step 2Thinking encryption is safe because the method is secret“To use a secret key, two sides must have shared it beforehand, in person or by some safe route.”Taken apart in step 3Thinking two strangers can't agree a secret without meeting first“If the padlock is showing, the site is safe and honest.”Taken apart in step 4Thinking the padlock means a site is safe“A certificate is just a file the site makes about itself, so it can't prove who the site is.”Taken apart in step 4Thinking a certificate proves nothing because anyone can make one“With HTTPS, nobody on the way, my internet provider or the Wi-Fi owner included, can see anything about where I go.”Taken apart in step 5Thinking HTTPS hides everything you do
Security

More on security

Why use a database instead of just saving files?26 min · freeWhy is the Fourier transform so important?28 min · freeWhy doesn't the Moon fall onto Earth?27 min · freeWhy does salt make ice water colder?26 min · free
The short answerRather read it than work it out?Show it (it gives the steps away)

A request crosses many machines: your router, your provider and several networks between. With plain HTTP each can read the whole thing and change it. That's true for every page, not just login pages, which is why HTTPS exists: to make the data meaningless to everyone except the two ends.

Modern encryption uses a published method and a secret key. Anyone can study how AES scrambles, so the method gets tested by thousands of people. Only the key must stay private, and a 128-bit key has about 3.4 x 10^38 possibilities, too many to guess even at a trillion tries a second.

With key exchange, each side picks a private number, mixes it into a shared public one, and sends only the result. Each then mixes the other's result with their own secret and both reach the same number. With g = 5 and p = 23, Alice's 6 and Bob's 15 both lead to the secret 2, though neither secret is ever sent.

Key exchange alone can't tell you who is at the other end: an attacker in the middle could agree one secret with you and another with the site. So the site sends a certificate, signed by an authority your browser already trusts, tying its name to its key. The padlock means the connection is private to that exact address; it says nothing about whether the owner is honest.

After the handshake, the data is scrambled with the agreed key using a fast cipher. That hides pages, forms and cookies, but the networks in between can still see which server you connect to, usually its name, when, and roughly how much data. HTTPS keeps the content private; it doesn't make you anonymous.

Make it yours

Learn it with your own tutor.

Add it to your goals and Cognosc starts from what you already know, works through the rest with you, and keeps checking you still understand it.