Network foundations · Lesson 3 of 5
What HTTPS does, and does not, mean
HTTPS uses Transport Layer Security, or TLS, to protect a connection. TLS helps provide confidentiality, integrity, and authentication between communicating applications.
A secure connection is not a trustworthy request
A browser connects to a fictional site using HTTPS.
- What TLS protects
Data in transit between the TLS endpoints. Certificate checks help verify the requested hostname.
- What you still judge
Whether the organization, content, and request are legitimate. A deceptive site can have a valid certificate.
Read the visualThe site uses HTTPS and asks for your work password. Is that enough reason to comply?
No. Independently verify the destination and request. Encryption does not make the request legitimate.
Protect data in transit
Encryption makes intercepted application data harder to read. Integrity protection helps detect tampering.
Validate the endpoint
A browser checks the server’s certificate for the requested hostname and other validity conditions.
Keep judging the content
A valid HTTPS connection can still lead to a dishonest website. Transport protection is not an endorsement.
Put it in context
A fictional scam site can have a valid certificate for its own domain. Your connection to that site may be encrypted while the request it makes is still fraudulent.
HTTPS protects the connection. You still have to evaluate the destination and the request.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.