8 ms·

How HTTPS works

163 points by AndrewDucker 8y ago

king007 8y ago
Hyper Text Transfer Protocol Secure (HTTPS) is an advanced version of Http, It provides more security By encrypt the data.
deleted 8y ago
[deleted]
king007 8y ago
Maybe this help https://robertheaton.com/2014/03/27/how-does-https-actually-work/ https://robertheaton.com/2014/03/27/how-does-https-actually-...
comboy 8y ago
OK, cute, but why? Who is the target here? Distraction to content ratio seems pretty high.
- rockdiesel 8y ago
  >but why? Content marketing and SEO purposes for the parent company, dnsimple.
ecesena 8y ago
Pretty amazing, congrats to the authors. As a technical person I don’t particularly love privacy = confidentiality, but I understand the desire to simplify. If you’re looking for something next, I vote for phishing. We tried to make a short explanatory video, but it’s not even remotely cool as this one! https://twitter.com/_conorpp/status/1036751355346595840 https://twitter.com/_conorpp/status/1036751355346595840
decebalus1 8y ago
I may very well be an old curmudgeon but am I the only one who doesn't like all this comic-y cutesy content? They seem to be a rebranded version of the old `Idiot's guide to X` which were ubiquitous in the '90s. Yes, I'm also talking about stuff like `Clojure for the brave and true` or `Learn you a X for the greater good`. Does anyone actually benefit from this content? I look at it and it seems to be targeted to 10 year olds. Are we as an industry getting dumber? For this specific subject, instead of reading about the `adventures of Certificat, Browserbird, and Compugter` can we just read something like https://hpbn.co/transport-layer-security-tls/ https://hpbn.co/transport-layer-security-tls/ ?
- coin 8y ago
  Way too obnoxious with all the comic stuff, I left after 20 seconds.
  - stevekemp2 8y ago
    There are several "celebrity" bloggers who keep this trend alive. I find it annoying too, but better that than some of the other approaches which involve constant! Exclamation!! Marks everywhere!!! A few zine-style approaches manage to capture the worst of both worlds, but I guess if others find it endearing and cute then good luck to them!!
  - alonmower 8y ago
    I made it decently far but the 6 frames of meaningless handshake pictures finally got me to close the tab in anger
- Rotdhizon 8y ago
  I think it has to do with who is reading. Some people learn better this way (myself included). I've seen many topics over the years explained in forms similar to this and it was very easy to understand opposed to just reading it out of a textbook. Although I'll admit that even this was done way too cutesy. They put far too many pictures with too small of text on each page, made it hard to follow along and keep focused. I need to be able to read fluently, small white text on a black background is hard on the eyes. You can find little snippets like this in many textbooks, but it's generally a single picture or two that are shown to better show the point made in the preceding text.
- 0x8BADF00D 8y ago
  Dunno about the industry getting dumber, but they certainly are getting lazier when it comes to UX. I could barely read it for 10s before my eyes started hurting.
  - vagab0nd 8y ago
    Same here. I don't necessarily hate the comic style. But for some reason this particular style makes it very hard to read and understand.
brink 8y ago
Why am I having such a hard time remembering that the dog is the computer and the cat is the certificate while reading this?
- sjroot 8y ago
  I had this issue even starting from the first panel after the introduction, where the dog was sending a message to the bird. I kept having to scroll to the top to double check who was who.
- caymanjim 8y ago
  I have this problem with most analogies used to explain things. Computer concepts are abstract enough without layering another abstraction on top. If you're trying to explain something complicated, you're just adding more cognitive overload. If you're trying to explain something simple, why not be direct? It's possible that I just run into nothing but bad analogies, but I don't see them as being helpful.
- egypturnash 8y ago
  Because it barely spends any time setting that up, for one thing. It would probably be a bit more memorable if the characters actually said things like “Hi! I’m Compugter! I sit on your desk or in your lap and talk to the Internet for you!”; instead there is just a panel with a tiny label floating off to one side. Or maybe it should be “Hi! I’m Compugter, I sit in a rack in a puppy farm somewhere, and talk to the browserbird in your hand or lap or desk”? It really doesn’t define its terms at all before launching into a description of a man-in-the-middle attack. This is just not well-written, and no amount of cute drawings will cover for that, no matter how well done they are.
AndrewStephens 8y ago
I found the layout confusing but stuff like this is desperately needed. Encryption is a difficult subject but so important to how the Internet functions; the better people understand the concepts the better decisions they will make. I tried to explain explain how the web browser retrieves a web page (including HTTPS) in simple terms once; the resulting text quickly got away from me[0] so I respect the creators of this for trying. [0] https://sheep.horse/2017/10/how_you_are_reading_this_page.html https://sheep.horse/2017/10/how_you_are_reading_this_page.ht...
blr246 8y ago
A major problem with this is that non-expert users might interpret it to mean that the "green lock" always means everything is ok. That is dangerous advice since it's possible to publish a phishing site having proper SSL. Users need more context than what is offered here to avoid becoming victims of phishing scams. I also found the content itself difficult to read in both layout and copy. The character names were confusing, and I don't think the three concepts of privacy, integrity, and identity were conveyed in a clear enough sense so that a non-expert could interpret how those are actually 3 different things.
hannob 8y ago
I skimmed over it and it seems to be a bit dated. The handshake description is basically a static RSA key exchange. This is deprecated in TLS 1.3 and largely unused even in older TLS versions, because it's horrible. (I wrote a paper to show how horrible it is.) Unfortunately I see this quite often that people are simply not up to date when it comes to crypto.
- commandlinefan 8y ago
  > I wrote a paper I'd be curious to read that paper, if you don't mind sharing a link - I recognize your name from the TLS mailing list, but I don't recall seeing that paper referenced there, and everything I google is in German...
deleted 8y ago
[deleted]
arayh 8y ago
I like the light-hearted direction taken to explain HTTPS, but I personally find the narrative difficult to read and follow. It might be unfair for me to compare the two, but I do like Randall's approach to explaining Heartbleed https://xkcd.com/1354/ https://xkcd.com/1354/ because it feels like it has a better flow. I'd definitely like to see this idea get expanded upon and improved, so I can feel confident about forwarding this link to non-technical users who are interested in learning how the Internet works. I also agree with doing one of these on phishing.
lozenge 8y ago
Self signed certificates do not prove integrity. A crab in the middle can generate another self signed certificate for the same domain name and your browser will not know that it isn't the one you expected. The only workaround is to manually add the certificate to the root store. But this depends on securely receiving the certificate - say by physically transferring it from one computer to another by USB stick.
bradenb 8y ago
I found this really hard to read. At first I tried to read left-to-right, top-to-bottom, but then it felt like the "panels" (or lack thereof) were not lining up. Then I thought "Oh! It must be three columns top-to-bottom" so I tried that then realized I was missing content and that I was right the first time. I'd love to see you lay this out a bit differently. Apart from that, I love the content. Thanks.

163 points by AndrewDucker 8y ago

Hyper Text Transfer Protocol Secure (HTTPS) is an advanced version of Http, It provides more security By encrypt the data.

deleted 8y ago

[deleted]

king007 8y ago

Maybe this help https://robertheaton.com/2014/03/27/how-does-https-actually-work/ https://robertheaton.com/2014/03/27/how-does-https-actually-...

comboy 8y ago

OK, cute, but why? Who is the target here? Distraction to content ratio seems pretty high.

rockdiesel 8y ago
>but why? Content marketing and SEO purposes for the parent company, dnsimple.

ecesena 8y ago

Pretty amazing, congrats to the authors. As a technical person I don’t particularly love privacy = confidentiality, but I understand the desire to simplify. If you’re looking for something next, I vote for phishing. We tried to make a short explanatory video, but it’s not even remotely cool as this one! https://twitter.com/_conorpp/status/1036751355346595840 https://twitter.com/_conorpp/status/1036751355346595840

decebalus1 8y ago

I may very well be an old curmudgeon but am I the only one who doesn't like all this comic-y cutesy content? They seem to be a rebranded version of the old `Idiot's guide to X` which were ubiquitous in the '90s. Yes, I'm also talking about stuff like `Clojure for the brave and true` or `Learn you a X for the greater good`. Does anyone actually benefit from this content? I look at it and it seems to be targeted to 10 year olds. Are we as an industry getting dumber? For this specific subject, instead of reading about the `adventures of Certificat, Browserbird, and Compugter` can we just read something like https://hpbn.co/transport-layer-security-tls/ https://hpbn.co/transport-layer-security-tls/ ?

coin 8y ago
Way too obnoxious with all the comic stuff, I left after 20 seconds.
- stevekemp2 8y ago
  There are several "celebrity" bloggers who keep this trend alive. I find it annoying too, but better that than some of the other approaches which involve constant! Exclamation!! Marks everywhere!!! A few zine-style approaches manage to capture the worst of both worlds, but I guess if others find it endearing and cute then good luck to them!!
- alonmower 8y ago
  I made it decently far but the 6 frames of meaningless handshake pictures finally got me to close the tab in anger
Rotdhizon 8y ago
I think it has to do with who is reading. Some people learn better this way (myself included). I've seen many topics over the years explained in forms similar to this and it was very easy to understand opposed to just reading it out of a textbook. Although I'll admit that even this was done way too cutesy. They put far too many pictures with too small of text on each page, made it hard to follow along and keep focused. I need to be able to read fluently, small white text on a black background is hard on the eyes. You can find little snippets like this in many textbooks, but it's generally a single picture or two that are shown to better show the point made in the preceding text.
0x8BADF00D 8y ago
Dunno about the industry getting dumber, but they certainly are getting lazier when it comes to UX. I could barely read it for 10s before my eyes started hurting.
- vagab0nd 8y ago
  Same here. I don't necessarily hate the comic style. But for some reason this particular style makes it very hard to read and understand.

brink 8y ago

Why am I having such a hard time remembering that the dog is the computer and the cat is the certificate while reading this?

sjroot 8y ago
I had this issue even starting from the first panel after the introduction, where the dog was sending a message to the bird. I kept having to scroll to the top to double check who was who.
caymanjim 8y ago
I have this problem with most analogies used to explain things. Computer concepts are abstract enough without layering another abstraction on top. If you're trying to explain something complicated, you're just adding more cognitive overload. If you're trying to explain something simple, why not be direct? It's possible that I just run into nothing but bad analogies, but I don't see them as being helpful.
egypturnash 8y ago
Because it barely spends any time setting that up, for one thing. It would probably be a bit more memorable if the characters actually said things like “Hi! I’m Compugter! I sit on your desk or in your lap and talk to the Internet for you!”; instead there is just a panel with a tiny label floating off to one side. Or maybe it should be “Hi! I’m Compugter, I sit in a rack in a puppy farm somewhere, and talk to the browserbird in your hand or lap or desk”? It really doesn’t define its terms at all before launching into a description of a man-in-the-middle attack. This is just not well-written, and no amount of cute drawings will cover for that, no matter how well done they are.

AndrewStephens 8y ago

I found the layout confusing but stuff like this is desperately needed. Encryption is a difficult subject but so important to how the Internet functions; the better people understand the concepts the better decisions they will make. I tried to explain explain how the web browser retrieves a web page (including HTTPS) in simple terms once; the resulting text quickly got away from me[0] so I respect the creators of this for trying. [0] https://sheep.horse/2017/10/how_you_are_reading_this_page.html https://sheep.horse/2017/10/how_you_are_reading_this_page.ht...

blr246 8y ago

A major problem with this is that non-expert users might interpret it to mean that the "green lock" always means everything is ok. That is dangerous advice since it's possible to publish a phishing site having proper SSL. Users need more context than what is offered here to avoid becoming victims of phishing scams. I also found the content itself difficult to read in both layout and copy. The character names were confusing, and I don't think the three concepts of privacy, integrity, and identity were conveyed in a clear enough sense so that a non-expert could interpret how those are actually 3 different things.

hannob 8y ago

I skimmed over it and it seems to be a bit dated. The handshake description is basically a static RSA key exchange. This is deprecated in TLS 1.3 and largely unused even in older TLS versions, because it's horrible. (I wrote a paper to show how horrible it is.) Unfortunately I see this quite often that people are simply not up to date when it comes to crypto.

commandlinefan 8y ago
> I wrote a paper I'd be curious to read that paper, if you don't mind sharing a link - I recognize your name from the TLS mailing list, but I don't recall seeing that paper referenced there, and everything I google is in German...

deleted 8y ago

[deleted]

arayh 8y ago

I like the light-hearted direction taken to explain HTTPS, but I personally find the narrative difficult to read and follow. It might be unfair for me to compare the two, but I do like Randall's approach to explaining Heartbleed https://xkcd.com/1354/ https://xkcd.com/1354/ because it feels like it has a better flow. I'd definitely like to see this idea get expanded upon and improved, so I can feel confident about forwarding this link to non-technical users who are interested in learning how the Internet works. I also agree with doing one of these on phishing.

lozenge 8y ago

Self signed certificates do not prove integrity. A crab in the middle can generate another self signed certificate for the same domain name and your browser will not know that it isn't the one you expected. The only workaround is to manually add the certificate to the root store. But this depends on securely receiving the certificate - say by physically transferring it from one computer to another by USB stick.

bradenb 8y ago

I found this really hard to read. At first I tried to read left-to-right, top-to-bottom, but then it felt like the "panels" (or lack thereof) were not lining up. Then I thought "Oh! It must be three columns top-to-bottom" so I tried that then realized I was missing content and that I was right the first time. I'd love to see you lay this out a bit differently. Apart from that, I love the content. Thanks.