2

HTTPS makes your data transmission secure by encrypting the traffic between the client and the server. Suppose an application has its own inbuilt encryption technique that encrypts data eg: (Login username and password).

  1. Is HTTPS still needed if the username/password is encrypted at the application level?
  2. How HTTPS make my data more secure even if I have encryption implemented at the software level?
  3. How do both concepts differ? And how it can be security loophole if one of them is not implemented in a very critical environment?
  • "need" and "more secure" only make sense based on what threats that you want to counter - there is more to protect than just the data that your application needs to function – schroeder Nov 13 '17 at 15:13
2

HTTPS make your data transmission secure by encrypting the traffic between the client and the server.

Encryption is only one part of the security when transferring data. The second and similar important part is the authentication, i.e. making sure that you talk to the correct server. And TLS also detects modification of the data on top of encryption. This is necessary since many encryption methods will not realize if the encrypted data got changed but instead simply decrypt these data to something different. Also, TLS allows you to securely generate a unique encryption key for the connection so you don't need to somehow exchange a common secret key to all parties up-front.

Is HTTPS still needed if the username/password is encrypted at the application level?

If all you need to protect are username and password and your protection is as strong as the one from TLS (i.e. strong encryption with unique and not pre-shared key, strong authentication, detection of modifications) then you don't need to use TLS too. But in many scenarios not only username and password are sensitive and need to be protected, but also the contents of the web site might worth being protected (like bank statements, health reports or similar) or even the URL you visit. And protection against modification is also needed, for example in online-banking. Also, often you have no infrastructure to securely exchange the encryption key and relying on a hard-coded key inside the application might be too insecure.

How HTTPS make my data more secure even if I have encryption implemented at the software level?

If everything is already encrypted with the same strength as TLS offers (see last point) then TLS does not add more security.

How do both concepts differ? And how it can be security loophole if one of them is not implemented in a very critical environment?

TLS provides end-to-end encryption between client and server application. With application level encryption you might add additional security if needed, for example by encrypting sensitive information not only during transfer but also at rest (file, database..).

A typical example to see these differences is mail delivery. TLS can be used when delivering the mail between each of the mail transfer agents (MTA). But on each MTA the mail is visible in plain since the TLS connection only protects the transfer between the MTA. If you want to add more security you can use S/MIME of PGP which add application-level encryption. This way the MTA can only see the encrypted mail and it can be decrypted by the final recipient only who has the encryption key (or can compute it).

1

HTTPS does more than 'encrypt' your data.

Besides encrypting it also exposes authenticity information (e.a. is the server who I think it is?)

It also is handled differently by browsers / API's than HTTP connections. (like not sharing details about whats being sent).

Also proxies / caches in between your client and server handle HTTPS diffidently from HTTP, like not send person B the encrypted content of Person A.

In short, HTTPS is about protecting the Data in transit. Encrypting the user-name / password / any data is more about protecting it at rest than in transit. these goals overlap off course but have subtle differences that make all the difference.

As example of one of the differences when doing a HTTP request like "http://example.com/mytoken/secretdata" everyone in the chain can see that URL (and could change / manipulate it).

While when we use HTTPS to do a request to "https://example.com/mytoken/secretdata" all anyone can see in the clear is the IP's involved and "https://example.com" the rest of the message is encrypted, and the full message is protected against tampering.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.