4 ms·

How about all it really means? "Encrypted"

• sverhagen 9y ago
  ESL, myself, but I wouldn't know if Encrypted makes a lot of sense for non-technical users?
• rocqua 9y ago
  HTTPS means more than just encryption. There is also authentication and integrity guarantees in SSL.
  • berbec 9y ago
    But the extras beyond encryption are definately not guarantees. [1] HTTPS means encrypted HTTP. Everything else is "I trust the certificate authority to provide oversight and verification." It may just be me, but I don't trust the fine, upstanding CAs we have now-a-days. 1: https://stripe.ian.sh/ https://stripe.ian.sh/
    • rocqua 9y ago
      Authenticity indeed is only guaranteed if you trust the CAs. Though it is still nice to know that getting a false cert isn't trivial. However, message integrity is a real benefit of SSL that doesn't need CAs. Consider the original article. In this case encryption doesn't matter and integrity does. Without message integrity, considering the login link has a known location and value, using bit-flips one might be able to change the login link (depending on the kind of encryption used). This message integrity is getting to be a much more important part of https. There are a lot of things that you don't want other parties able to change. Maybe even more things than you don't want them to be able to read.
  • ryandvm 9y ago
    That's my point. There is no guarantee about authenticity. Anyone can register a domain and have an SSL cert from Let's Encrypt in less than 15 minutes. The only thing that HTTPS guarantees is that you are communicating securely with the person that owns the domain. That's it.