0

A lot of websites tell that HTTP is insecure, but if I manually change the address bar URL from http:// to https:// in a website I visit does it provide security regarding the connection?

Because all the websites that I visited so far which were using the HTTP protocol and I did this worked. I know that major websites redirect from HTTP to HTTPS. So if I do this and it works, does it simply mean that the website is not redirecting to HTTPS?

2 Answers 2

2

if I manually change the address bar URL from http:// to https:// in a website I visit does it provide security regarding the connection?

Yes, it provides all the standard things TLS provides:

  • Authentication (you know you're talking to the expected webserver, not to some attacker impersonating it).
  • Confidentiality (your network traffic to and from the server is encrypted; no attacker can know what is sent in each direction).
  • Integrity (your network traffic is secure against tampering; you know that the server sees what you sent, and you see what the server sent, without modification en route).

Mind you, there's lots of stuff that HTTPS / TLS doesn't provide. It doesn't fully hide who you're talking to. It doesn't conceal how much data you send or receive. It doesn't give you the ability, after the fact, to prove somebody said something (nobody knows whether you modified it in the meantime, see e.g. fake Twitter screenshots). It doesn't hide your IP address or otherwise make your location unknowable. It doesn't protect you from vulnerabilities in the web application. It doesn't mean that content you receive is safe to open.

Because all the websites that I visited so far which were using the HTTP protocol and I did this worked. I know that major websites redirect from HTTP to HTTPS.

It's a little surprising that this would work on all websites that you tested, without any errors. Most sites that fully support TLS automatically redirect to HTTPS these days, and the rest usually have incomplete configurations (untrusted or expired certificate, certificate issued to a different site such as the hosting provider of your target site, outdated protocol support). I know of a few such examples. Still, it's good news that HTTPS support is so widespread now.

So if I do this and it works, does it simply mean that the website is not redirecting to HTTPS?

Yes. If the page loads correctly and without any warning message (and are using a modern browser), that means your connection is secure and you could do all your browsing for that site via the secure connection. There's even a browser extension to do this for you on a lot of sites where it's known to work: HTTPS Everywhere.

Mind you, as Steffen pointed out, sites that aren't specifically intended to be used with HTTPS may have links (or other forms of navigation) within them that explicitly redirect back to plain HTTP. Also, even if you do all your browsing for that site over HTTPS, any cookies it set on your computer might still be vulnerable to a network-based attacker (somebody on your LAN, or otherwise between you and the server), so be very wary of signing in (or otherwise doing anything unauthenticated) on a site that supports plain HTTP (in any way other than a redirect) at all.

2
  • So I've been using HTTPS Everywhere for over a year now and I didn't know it was intended for that. I mean I know it has something to do with that because of the name. I just saw another person using it and they said I should install it because it would protect my connection, so I did it. So that means that those sites I visited weren't covered by HTTPS Everywhere? I am currently using the pre-installed Edge Browser from Microsoft.
    – Emanoel
    Feb 22 at 2:19
  • Yep, sounds like HTTPS Everywhere isn't aware of HTTPS support in those sites. This is a relatively common problem; the web is big, sites add or change their HTTPS support all the time (usually without announcing it), and obviously a browser extension must be careful because if it tries to force HTTPS on a site that isn't actually supporting it, at best you'll get a scary security warning, and at worst the site just won't work.
    – CBHacking
    Feb 22 at 3:54
0

If it works without any warnings or errors by simply replacing the http:// in the URL with https:// then the communication is successfully secured.

Be sure though that it stays https:// all the time - if the web site was not (yet) intended to be used with https:// only then there might be some places where it switches back to http:// because the migration to https:// only might not be complete.

5
  • My question wasn't that clear, but it was regarding the security of the connection. So in this situation it means that a website is simply not redirecting to HTTPS? The websites I did this were supposed to be secure, I know the owners of these websites. One of these websites I filled a form with some private information, when I first entered the URL the website was HTTP, I manually changed it to HTTPS. So in this situation I can presume my connection was secure, even though the website wasn't redirecting to HTTP, and I needed to do this manually?
    – Emanoel
    Feb 20 at 17:14
  • @Delfino: like I said - if changing to https:// works and does not lead to errors or warnings, then the connection is properly secured. Be sure though that it actually stays as https:// all the time and that the site does not switch back to http:// for some content. Feb 20 at 17:17
  • Last question, is there any real example of a website that I would enter HTTPS:// and show me an error message or something?
    – Emanoel
    Feb 20 at 17:23
  • @Delfino: I don't have any specific example but I'm pretty sure that there are still lots of smaller sites which are not or not properly setup with https and where trying to use https will lead to various errors since either it will not work at all, will use some default self-signed certificate, will use a certificate from a different domain on the same shared hosting, will use some expired certificate from earlier tries to enable https ... Feb 20 at 17:29
  • @Delfino or an expired certificate for example, or a certificate that got revoked... there's quite a few possible errors/warnings Feb 20 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.