Is there any difference between HTTP and HTTPS when using my home / own internet connection

Question

First of all I am a web developer and not a security expert. I have read lots of articles about the difference between HTTPS and HTTP, including this site.

The basic idea I got from them is, when using HTTPS all things are encrypted on the client side and then sent to the server. (Please correct me if I am wrong)

So even our network admin or other person in the network can't get anything.

When I use my laptop at home (trusted network), is there any advantage of using HTTPS over HTTP?

Answer 1

TLS provides three things:

• Confidentiality: that nobody can see the traffic between you and facebook.com (including the guy at the next table at Starbucks, your ISP, some sketchy network equipment in the datacentre COUGH NSA, nobody).
• Integrity: that nobody is modifying the messages as they travel between you and facebook.com (this is separate from Confidentiality because some kinds of attacks allow you to modify the message in a malicious way even if you don't know what the messages are).
• Authentication: that you are talking to the authentic facebook.com server, not a spoofed version of it.

---

The basic idea what I got from them is, when using https all things are encrypted in client side and then sent it to the server. (Please correct me if I am wrong)

That covers the confidentiality and integrity parts, but you're missing the authentication part:

To prove that you're not talking to a spoofed web server.

Say I set up a phishing version of Facebook and I somehow hack into your home router (easy) or ISP (harder) so that when you type facebook.com it resolves to my IP address instead of the real one. I've created an exact copy of the login screen you expect and you'll enter your username and password. Muahaha! Now I have your username and password.

How does HTTPS prevent this? Answer: with Certificates:

If we open up the certificate in my browser's Dev Tools > Security, we'll see this:

DigiCert is what's called a Publicly-trusted Certificate Authority (CA). In fact, DigiCert is one of the CAs that your browser inherently trusts because its "root certificate" is embedded into your browser's source code. You can see the full list of trusted root CAs by digging around in browser Settings and looking for "Certificates" or "Trusted Roots" or something.

So, your browser inherently trusts DigiCert, and, through this certificate, DigiCert has certified that the server you are talking to is the real facebook.com (because it has the private key that matches the certificate). You get the green padlock and you know that everything is good.

---

Just for fun, let's make a fake facebook.com. I added this line to my hosts file so that any time I type facebook.com it will redirect to google.com's IP address:

209.85.147.138  facebook.com

Google, what'cha doing trying to steal my facebook password?? Thank goodness HTTPS is here to protect me! My browser is super unhappy because the certificate it was presented (for google.com) doesn't match the URL it requested (facebook.com). Thanks HTTPS!

Answer 2

Short answer:

HTTPS intends to establish a secure connection between a registered website and its user computer, so you can be sure, that the visited site is really what you wanted to visit, and the data is not acquired/altered in transit.

Long anser:

If I understood you correctly, your basic idea is, that only a network admin can monitor your activity, and there is no such thing at home. This is not the case.

Any individual, group, company(ISP) or state can see and alter the transit, and by that infect your computer. The internet nowadays is rather a cyberwarzone, where the mentioned entities often attack even their allies to steal information=money=power, gain control, threaten or physicall injure people through hacking. Even state tools are available for individuals on the black market. Persistent tools/malware survive changing the hard drive, so they can monitor/harm you in long term.

The problem with https is, that it can be also hacked many ways, thus it gives you a false sense of security, which might be more dangerous.

This is why it is important to use https, whenever you can, and care about system security too. You can download extensions for browsers to automatically direct you to HTTPS sites, when it is possible.

Answer 3

The other answers so far are good. I'll add one more angle: The Internet is a loosely connected mesh of routers; your home wifi router is only one of them. Any HTTP connection you make to a web server elsewhere on the net typically takes a path through a dozen or so routers to get there. That path changes frequently depending on network conditions; you can't predict whose routers you will be using. Each of these routers is owned and managed by a different person or company[1].

All of those people have the ability to watch your data as it goes past. They might do this on a routine basis, in non-malicious situations, during the course of everyday troubleshooting, because that mesh of routers needs constant monitoring and administration to keep it running at all; this effort encompasses several career fields alone. (The people who choose these career fields tend to be rather adamant about good security and tend to take their social responsibility seriously, but the only thing keeping them out of your data in a practical sense is their own conscience and reputation.)

So the equipment, software, and capability is already there; all a bad guy has to do is co-opt someone else's router or monitoring system.

HTTPS connections take the same path, but because they are encrypted, only the web server's administrator can see the cleartext content; the router administrators will only see what looks like random noise. (The web server itself might be compromised, but that's a different problem.)

[1] Playing with the traceroute or tracert command yourself will give you a glimpse of what these paths can look like.

Answer 4

With HTTP, information flows through this pipeline between your computer and the server:

From left to right: your computer, the airspace surrounding your computer and your wifi router, your router, the cable to your local ISP box, your local ISP box, a vast network of devices and wires that you know nothing about and have no control over, the server's local ISP box, the cable to the server, and the server itself.

Anywhere in the red area, the information can be snooped and tampered with. Anyone controlling one of the red boxes can snoop and tamper with the information. Anyone at all can break open one of the red pipes and gain access to the information flowing through it and snoop or tamper with it.

Your information is only safe within the green and blue boxes and pipes.

With HTTPS, information flows through this pipeline:

Your computer and the server establish a virtual pipe that can't be broken open, and run it through all the pipes and boxes between each other. Now your information is safe at every point in transit.

Answer 5

Yes, there's a tremendous advantage to utilizing HTTPS over HTTP.

1. HTTP is not encrypted through PKI, and as such, all information is passed via plain text, readable by a packet sniffer and every piece of equipment those packets pass through once they exit the modem.
2. With HTTP, there is no way for one to know whether the owner of the site is who they say they are, and as such, no way for one to know if they're being subjected to a MITM attack.
   • This is why it's recommended to always utilize HTTPS if a site offers it, since this is the only way a user can trust the content they're being served has not been tampered with.

With HTTPS, all information sent and received is encrypted via PKI, at minimum with a 1024bit/equivalent encryption key and SHA256 hash, however many sites have switched to 2048bit/equivalent, and any site processing logins is more likely than not using a 2048bit/equivalent encryption key.

• For example, when utilizing HTTP, all equipment those packets pass through can read exactly what information is being sent and received (this includes passwords, account & CC numbers, etc.); however, if utilizing HTTPS, all that could be read would be the header info.

Your question also comes up a lot with router WebUIs on LANs, and even though that traffic never leaves the local network, it should still be accessed via HTTPS only, else all passwords, including root's, will be sent as plain text.

• It doesn't matter if a person is the only one on/accessing their local network... if passwords/sensitive information must be sent/received, it should always be accessed by HTTPS only, especially when it only takes a few minutes to generate a self-signed CA or CA/ICA, and use the CA or ICA to sign a CSR for the server.

Answer 6

Even if you don't care too much about the possibility of your ISP/government being evil, there are at least two attacks that are easy to perform against your home connection so that HTTPS will be the only thing protecting your data:

• The evil twin attack where someone sets up a wifi router with the same name as yours but with a more powerful signal, so that you end up connecting to them instead of your own wifi router (typical home wifi setups only involve one-way authentication - the laptop proves its identity with the password, but the router does not have to prove itself).
• Hijacking the router, which is often easy - router software tends to be insecure, and there is no security update process, so once a vulnerability for your specific router version is discovered, your router remains vulnerable forever. There are various ready-made tools and even automated malware out there which target routers. E.g. this attack happened a few months ago.