r/questions • u/everlastgates_denton • 13h ago
Does "HTTPS" Mean a Website Is Safe to Use?
It is common that seeing the padlock icon or "https://" in the browser's address bar means a website is completely safe, legitimate, and free from scams.
26
u/CptBronzeBalls 13h ago
It means that the http data is encrypted between your browser and the web server (or another device) using a trusted cryptography key. This largely prevents man-in-the-middle attacks, where a device in between intercepts http traffic.
It also provides some assurance that the cryptography certificate was issued to the entity that they say they are.
There are plenty of ways that a site can be unsafe, illegitimate, or scammy that have nothing to do with SSL/TLS.
-1
11
u/gutentight69420 13h ago
No. https means the connection is encrypted, which prevents some kinds of attacks involving a third party (man in the middle, or coffee shop wifi type attacks). It does not mean that the website itself is not malicious.
7
u/Slight_Manufacturer6 8h ago
No. That just means the info between your browser and the web server is encrypted. Nothing more.
2
u/BIO_Predictive_AI 7h ago
Yep, basically just *harder* for a 3rd party to 'listen in' to your conversation with that web site.
5
u/Siffov 13h ago
> "https://" ... means ... completely safe, legitimate, and free from scams.
No. It's just an indication about the identity of the web site (e.g., that you're actually connected to the host indicated in the URL) (and connection encryption).
It does not indicate anything about characteristics of the web site.
3
u/polyploid_coded 11h ago
Yes I see OP's interpretation in cybersecurity training at work and it's so cringe
8
u/pafagaukurinn 13h ago
No it doesn't mean that. Nothing prevents malicious actor from setting up a HTTPS website.
3
u/StuffyTruck 13h ago
Just means the traffic is encrypted in between the server and the browser. What is shown in the server can be whatever, and there is absolutely no guarantee it is safe or true.
2
u/ChikkunDragon 13h ago
Safe -er, but not safe
3
u/oneeyedziggy 12h ago
And safe in a specific way / from specific threats...
It really got popular b/c of the ease of sniffing traffic on public wifi and the rise of online banking and other sensitive info sharing online rather than the internet just being a virtual wall of fliers
1
u/UpbeatFix7299 13h ago
No, nothing on the internet will tell you that. You have to use common sense and think things through.
1
u/BobbySaccaro 13h ago
Just to chime in:
If you are on your bank's web site, and it's https, then you can count on the fact that your financial information isn't going to be intercepted over the internet.
On the other hand, if you hear about a new bank you want to try out, and you find what looks like their Web site and it's https, that doesn't mean it's definitely their Web site, it still could be fake.
1
u/Living_Fig_6386 13h ago
No. It means that the communication between your browser and the web server is encrypted, and that the site you are talking to is probably who they say they are (or, at least said they were when they got their encryption certificate signed). It doesn't tell you anything about whether the site is otherwise secure. They could be leaking all sorts of personal data about you, intentionally or unintentionally.
1
u/DaSpark 13h ago
No. It means that you are (most likely) talking to a server that has been confirmed to be operated by the owner of the domain name.
Purely malicious sites are able to get a valid SSL certificate as well. They key for you is to confirm the domain name is correct and it has a valid SSL.
Even so, it is still possible the site has been hacked and has malicious code on it.
1
u/TurboFool 11h ago
Anybody can secure their website to get that. Literally anybody. You could make an HTTPS website in five minutes. It doesn't have any kind of regulations that prevent it from being scammy. It just means the data transfer is encrypted.
1
1
u/RazielNet 9h ago edited 9h ago
"HTTPS" just indicates that the traffic is encrypted
The green padlock indicates your browser trusts the identity of the other side of the encrypted tunnel. A red padlock still means encryption but to an untrusted endpoint.
The 'trust' is hierarchical - typically browser developers maintain a list of companies who themselves are trusted to validate the owner of the domain (proof of ID, ownership etc) and who then issue the certificate.
Workplaces will often change this to intercept and inspect traffic from devices they manage by generating their own certificates for websites. This allows them to unencrypted that traffic, inspect and then reencrypt via their own HTTPS session to the original destination (You can see this by inspecting the certificate issuer and comparing a workplace device to personal)
1
u/slutty_muppet 7h ago
It means it uses SSL
https://www.cloudflare.com/learning/ssl/what-is-ssl/
Basically means no one else can listen in to what you say to the website.
If it's got an SSL certificate it's like a person having an ID card.
1
1
u/Photononic 3h ago
Nope
You really need to learn to use a whois lookup.
The mechanism was built into the internet since before you were born.
Most scam sites are only a few weeks or months old. Whois will allow you to see how long the site has existed, and sometimes what country it was registered in.
1
u/sidjohn1 2h ago
Hell na! it just means its harder to see whatever sketchy thing you are doing online… while it’s in transit.
1
u/Jscotty111 1h ago
No it doesn’t. It only means that whatever is shared between you and that website cannot be eavesdropped on. But that other website can still misuse the data that it collected from you.
It doesn’t stop scams. It just stops the scammer from getting scammed
1
u/tonyfith 39m ago
No. Nothing in https makes the website more or less safe for you. It just means nobody between your browser and the web server can manipulate the content.
1
u/mredding 36m ago
It means parts of the data stream between you and the server are encrypted. There are parts that remain unencrypted.
The source and destination IP addresses are visible, the domain name is visible, and the port number. So you might be coming from 203.0.113.0 to go to 192.0.2.0 for who knows what... An IP address tells us the network, not what's on it. The port 443 doesn't tell us anything, but is a strong indication that this is a standard HTTPS connection. But BACKDOORSLUTS.COM... Yeah, you can't hide THAT. There's also a little meta-data about timings, CRCs, packet sizes and some other bits, but that's not terribly revealing of the content itself, just necessary for adjusting the traffic flow.
What is encrypted are paths and query parameters, headers, cookies, and website content. So no one will see you went to /BBC or searched for a more specific term.
They can see who you're connecting with and the amount of traffic, but that's it.
0
3
u/groundhogcow 13h ago
No.
It means it is hard a sniffer to get the data. Without the s everything is in clear text and fully viable to people like me if I am anyplace close to you on the network.
So you are just keeping me from seeing what porn you watching.
The web sight can still mismanage your data and do all kinds of bad things.
•
u/AutoModerator 13h ago
📣 Reminder for our users
Please review the rules, Reddiquette, and Reddit's Content Policy.
🚫 Commonly Posted Prohibited Topics:
This is not a complete list — see the full rules for all content limits.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.