Quiz
Warm-up from lesson 6-2: the Secure attribute on a session cookie means "only send this over HTTPS". What is the risk it prevents?
Who can read your traffic?
Every request you send crosses machines you do not control: the coffee-shop Wi-Fi router, your ISP, a dozen internet routers. With plain http://, all of them see your traffic exactly as you learned to read it in unit 4: the path, the headers, the cookies, the body with your password in it. Readable text, hop after hop.
TLS (Transport Layer Security) fixes this. HTTPS is just HTTP sent through a TLS-encrypted connection, and it buys you three distinct guarantees:
- Confidentiality: the traffic is encrypted, middlemen see only scrambled bytes.
- Integrity: if anyone tampers with a message in transit, the receiver detects it and rejects it.
- Authentication: you are cryptographically sure you are talking to the real
yourbank.com, not an impostor (next lesson).
Encryption itself is an old idea: transform the message with a secret key so that only someone with the key can transform it back. Let's build the world's simplest version to feel the mechanics.
Code exercise · python
Run this. A toy cipher: shift every character's code up by a secret key to encrypt, down by the same key to decrypt. Both sides must know the same key. (Real TLS uses vastly stronger math, but the shape, same key in, same message out, is the same.)
Code exercise · python
Your turn. You are the intended receiver and you know the shared key is 7. Decrypt the intercepted message and print it. ord(c) gives a character's number, chr(n) turns a number back into a character.
The key exchange problem
Our toy cipher has a fatal flaw shared by all symmetric encryption: both sides need the same key, but you and yourbank.com have never met. If the server just sent you the key, every middleman would see it too, and the encryption would protect nothing.
The TLS handshake solves this. Right after the TCP handshake from lesson 3-2, the browser and server exchange a few special messages that use asymmetric cryptography, math with a public key that anyone may see and a private key only the server holds, to agree on a fresh shared secret that eavesdroppers watching every message still cannot compute. From then on, everything is encrypted with that shared secret.
You saw this happen in lesson 5-1 without noticing: curl's -v output printed SSL connection using TLSv1.3 between the TCP connect and the first HTTP line. That line is the handshake completing.
Quiz
Over HTTPS, which of these can a nosy Wi-Fi operator still see?