The padlock: what it says and what it doesn’t say

The padlock icon displayed by your browser is arguably the most widely recognised security symbol in the world. It is also one of the most misunderstood.

The ‘S’ in HTTPS

HTTP transmits everything in plain text. On a shared network — a train station Wi-Fi, for example — anyone can read what’s being sent:

HTTP    :  (browser) ---- (legible text) ----> (server)
HTTPS   :  (browser) ---- (text figure) ----> (server)

HTTPS is HTTP carried over TLS (Transport Layer Security), the layer that encrypts and authenticates.

The three guarantees

TLS provides exactly three things:

• confidentiality: an eavesdropper cannot read the content;
• integrity: they cannot alter it without being detected;
• server authentication: you are indeed communicating with the machine associated with the displayed domain.

This third guarantee is the most valuable and the most often overlooked. Without it, encryption would be pointless — you’d have a perfectly secure tunnel leading straight to a fraudster.

What the padlock doesn’t tell you

Here’s the misconception you must absolutely avoid: the padlock says nothing about the site’s legitimacy.

It certifies that the connection to exemple.com is encrypted and that this server is indeed that of exemple.com. It does not say that the site is legitimate, that your data will be handled properly there, or that it is not a fake.

A phishing site can obtain a valid certificate in a matter of minutes, free of charge. It will have its padlock. Virtually all fraudulent websites now use HTTPS.

What remains visible

Even with HTTPS, a network observer can glean certain information: the domain name you are visiting, the volume of data exchanged, and the times. They cannot see the specific pages, forms or passwords.

In other words: TLS protects the content, not the fact that the conversation is taking place.