6

TL;DR: Is there any difference between an authentic and a secured website? More precisely, is there any security benefit to be connected to a website via HTTPS if the certificate isn't valid?

Following a test I had today where we was asked if it was better to be on a secured website or on an authentic website when browsing on a shopping website, I wondered if there was any difference between secured and authentic.

IMO, by definition, an authentic website has to be secured, otherwise any authentication of the website would be meaningless.

But then, is it true in the other way? Is a secured website necessarily authenticated? Can we still consider that you are using HTTPS and that there is a security benefit to it if the certificate isn't valid?

From my personal understanding, while a "non-authenticated asymmetrically secured connection" will be less secured than an authenticated one, there is still the benefit that as long as no man in the middle attack occurs, nobody will be able to decode what was transmitted, am I right?

  • do you mean by authenticated website that the user has logged in ? otherwise better use 'authentic' website instead. – elsadek Dec 9 '16 at 18:02
  • @elsadek Well, the question of my test wasn't asked in English but in French, but the adjective (authentitifcated - "authentifié") definitely seems to apply to the website itself, not to the actual user. – Trevör Dec 9 '16 at 18:04
  • 2
    It's theoretically possible for SSL to perform authentication without encryption. In practice, nobody enables the required options in their SSL libraries. – Mark Dec 9 '16 at 19:36
  • "...is there any security benefit to be connected to a website via HTTPS if the certificate isn't valid?" Curious, wouldn't using a self-signed (and therefore 'invalid') cert be more secure if you distrusted the current Certificate Authority model? Your site + your cert = no third-party requiring trust. – Tom Brossman Dec 9 '16 at 21:49
  • @TomBrossman But how do you distribute your certificate ? ;) – Trevör Dec 9 '16 at 22:32
9

Generally speaking, you are corrct. You are still connecting via HTTPS, as you surmised. Authentication, however, is indeed a critical part of TLS and HTTPS security. Even though the data is protected by TLS, without a valid and correct certificate, you can't be certain who you're actually talking to on the other end. It may be a server for the site you expect. It's very hard to know, however, if in fact there may be a man-in-the-middle instead, decrypting and examining (and possibly tampering with) the traffic in the clear before re-encypting it to forward back and forth between you and the site you think you're talking to.

So while there is a certainly a possibility that an unauthenticated connection might still be secure, it's quite difficult to know, and in most cases a certificate errors is indeed going to be an indication that something is amiss with the connection.

  • Thank you for your answer, so in that case, should I consider an "authenticated website" more secured than a "secured website"? The real issue here is that the exact meaning of "authenticated" and "secured" wasn't clear in the test, but since there is some distinction between those two, I believe I should assume that, since one ("authenticated") necessarily implies the other ("secured"), then it is than one that has the highest level of security... – Trevör Dec 9 '16 at 17:54
  • 3
    @TrevörAnneDenise Unfortunately, I think it is more nuanced that that. While authentication is a critical part of the protocol, you could certainly have authentication without security. (Though nobody implements it, TLS allows for a null encryption ciphersuite, for instance, which would allow an authenticated site to offer no particular transport security, even over HTTPS.) While it is likely that your interpretation of what the test meant is correct, I think you would need to ask the lecturer about the intent of the question to be sure. – Xander Dec 9 '16 at 18:18
  • Oh I understand. Well since this is a national test that has, as one of its goals, to make people have a safer use of the internet, I would be surprised if they considered it necessary to take into account such details that no "usual user" will ever encounter.. – Trevör Dec 9 '16 at 18:25
5

Yes. Even though someone could be MitMing you, other people on the line still can't see what you're doing. You can also manually check the public key for self-issued certificates for example.

  • Thank you! 🙂 In the end, do you think I should consider an "authenticated website" more secured than a "secured website"? The real issue here is that the exact meaning of "authenticated" and "secured" wasn't clear in the test, but since there is some distinction between those two, I believe I should assume that, since one ("authenticated") necessarily implies the other ("secured"), then it is that one that has the highest level of security... – Trevör Dec 9 '16 at 17:56
  • 3
    Don't get me wrong, there's "some" security in HTTPS with invalid certificates, but it's more close to no security at all. Aim for an "authenticated website" as a minimum in practice. Though it's not surprising to see a lot of internal apps using invalid certs. – billc.cn Dec 9 '16 at 18:11
  • That confirms what I thought about it... thank you !! :) – Trevör Dec 9 '16 at 18:13
  • 3
    All the answers are skirting around this, but this one gets closest. If your threat model (i.e. the kind of attack you're worried about) is an adversary with read-only access to the data stream, then you don't worry about authentication because, by definition, he can't alter the data the server sends. Authentication is necessary to defend against read+write (i.e. MitM) attacks, but there is a non-empty subset of attacks that are defeated by even unauthenticated HTTPS. However, MitM attacks are a big enough concern that your threat model should account for them in most circumstances. – Aoeuid Dec 9 '16 at 19:22
2

So, if you choose to continue, are you actually browsing with the http protocol ? Or the https protocol?

Indeed you are browsing the website using https, it is just the issuer of the SSL certificate that the browser doesn't trust.

I was asking myself this question following a test I had today where we was asked if it was better to be on a secured website or on an authentificated website when browsing on a shopping website. That made me wonder if there was any difference between secured and authentificated.

My guess this is a 'trap' question. The two address two different purposes:

"authentificated website" : The website knows that the right user is shopping.

"secured website" : The user knows that he is shopping on the right website.

Update:
In my humble opinion the term "authentic website" is not commonly used in Information Security, unless you put it in a specific context.
That being said the only difference between 'authentic' website and a secured website, is that the first one has the SSL certificate issued from a trusted Certificate Authority (CA), CA

  • May be a trap yes, but that would be insane to trap people with terms that have some real meaning and validity depending on how you interpret it. – Trevör Dec 9 '16 at 17:59
  • Especially since, at least in my language (but I guess it must be the case in english too), in "site web authentifié",the "authentifié" adjective applies to "site web", so I don't see how that would have any link with the actual user. – Trevör Dec 9 '16 at 18:02
  • @TrevörAnneDenise, check my comment above, I think you want to use the term 'authentic', which mean I have to review my answer. – elsadek Dec 9 '16 at 18:04
  • Yup updated the question 🙂 – Trevör Dec 9 '16 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.