Networks

Ask something
Discussion Locked

'http':// vs'https':// in an address. Do people still believe this???

0 helpful
15 replies

by sleepin'dawg

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

.
[i][b]I received this, this morning and almost fell off my chair laughing. I wasn't sure whether to pity the sender or take her seriously. No wonder the scams are so successful if this is the only criteria being used to determine a secure connection.[/b][/i]

Subject: The difference between http:// and https:// in an address
Hello All :

Don't know how many are aware of this difference, but worth sending to any that do not......

What is the difference between http and https

Maybe you already knew this, but I thought it was important enough to send even if you already know.
I didn't know this.....................

FIRST, MANY PEOPLE ARE UNAWARE OF

**The main difference between http:// and https://xn--6a/; is It's all about keeping you secure**
HTTP stands for HyperText Transport Protocol,

Which is just a fancy way of saying it's a protocol (a language, in a manner of speaking)
For information to be passed back and forth between web servers and clients.
The important thing is the letter "S" which makes the difference between HTTP and HTTPS.

The S (big surprise) stands for "Secure".
If you v isit a website or webpage, and look at the address in the web browser, it will likely
begin with the following: http://.

This means that the website is talking to your browser using the regular 'unsecure' language.
In other words, it is possible for someone to "eavesdrop" on your computer's conversation
with the website. If you fill out a form on the website, someone might see the information
you send to that site.

This is why you never ever enter your credit card number in an http website!
But if the web address begins with https://, that basically means your computer is talking
to the website in a secure code that no one can eavesdrop on.

You understand why this is so important, right?

If a website ever asks you to enter your credit card information, you should automatically
look to see if the web address begins with https://. If it doesn't, there's no way
you're going to enter sensitive information like a credit card number.

[b]Dawg[/b] ]:)

15 replies

by ic-it

Please edit your title. I (we?) can't open it from the discussions page due to the http:// Start of the title.

I had to come in through your profile-discussions started.

by jdclyde

then realized, despite having lost it all long time ago, that this issue was not my fault this time..... :D

by sleepin'dawg

the start of the line; the http:// seemed to send it off somewhere into the TR ether.

[b]Dawg[/b] ]:)

by jdclyde

Because as I was going down my list of skills that should go on a new resume, and which need to be updated, I wondered what has been done with https these days.

by jamesrl

I haven't set up any secure sites lately, but back in the day (14 years ago) when I set my first secure site, getting a the cert to make your site SSL secure (https://) was a pretty big deal. Of course by now I'm sure lots of illegitimate sites have ssl too.

But I do make sure if I am logging onto any of my trusted sites, that they are SSL too.

My bank goes one better, and has a list of personal questions they ask me on a random basis. A keylogger would have to capture a number of sessions to be able to break in to my bank account.

I wouldn't trust a site just because they had SSL. But I wouldn't suggest SSL is totally useless either -it is a barrier to script kiddies etc.

James

by mschenkel

I see a ton of sites out there where you can logon directly from the site's main page, which is not https. The main page has a "User Name" and "Password" field and Submit button.

Once logged on, however, the page returns back https. Is this initial transfer of user name and password visible for all to see??

Is there a problem with making your entire site SSL enabled? Or does this degrade performance?

by kdust111

For the bank and credit card sites I visit, I save the page they take you to after you hit the logoff button. All the ones I use provide a different logon page with an https address as opposed to their main page where you can login on a http, non-secure, level.

by jaqui

yes.

simply, using https for the entire site adds the overhead of encryption and decryption to both ends of the connection, it does low ANY site down.

The current "best practice" is to use https for all data that is sensitive. logon, credit card, account billing history...

otherwise, stick with http for the content.

edit to add:

Ipersonally think that everything should be via https, even though it is a performance hit, simply because https also stops cross site scripting, records accurate log info about sql injection exploits, kills pharming sites....
essentially destroying most criminal activities online.

by rob mekel

If the initial webpage isn't '[b]https://[/b]' all info send by is (can be) subject to eavesdropping. Never mind that the return is in https.
You're initial request is on an open line. Therefor not encripted ... ergo not save.

On the perfomance item.
Yes, encription takes computing power/time to encript and de-cript. So it can be that it's hardly noticeable ... but it will slow down your web-site.

One way to handle this is make your web-site-info not-encripted [b]but[/b] as-soon-as the visitor has the urge to give you some private information, make sure they first hit an encripted-page were they can put in their private stuff.

So ... make the logon-stuff an https:// page on your web-site.
And still this is just the [b]first step[/b] into a more secure way of transferring private information over the Internet

by older mycroft

The second 'T' stands for TRANSFER.

With misinformation like that you were probably being scammed! :)

by captbilly1eye

Including Snopes:
http://www.snopes.com/computer/internet/https.asp

I received the same email forwarded by a friend asking whether it was true or not, and like I usually do, I referred them to Snopes. However, in this case I added an amendment advising that there ain't no such thing as totally 'secure.' I also included this little graphic I made:
http://tinyurl.com/clpg73
...advising them to look for the locked padlock icon in the bottom right corner of IE and Firefox.

by rob mekel

You know that the snopes site does install some stuff on your pc ... don't you
Whether that be ok or not ... I can't tell.

So being very happy with the safe side ... hence company policies ... it isn't allowed in :)

You're tinyurl is very clear on where to look :) I think a lot of ppl will be happy with that.
[i]may be that tr-members ain't just a bunch of ppl[/i] :D ;)

Edited for the italic and emoticons

by mikejaegellive

The http format is used in many web pages and on many sites for information and publications desired to be shared and read. Note the addresses for pages on this website will all be on all http addresses aka www where as a check out or purchasing page is done on the https format which by the way is not a www address. Google does this also on their pages using https only when money is being paid or private account information is involved.

PS - Google sites have converted recently to 100 percent https and that bites. Now all of the Google Sites whom desire pages for public communication and maximum visibility which is done best in http - "evidenced by google site design itself, check their own web design". LOL- Now they hurt their own web designers on Google sites, by taking away www - aka http addresses. This urks my brain... cause Google has smart people.

This discussion is closed to new replies.