Linked Questions

419 votes
14 answers

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
Joshua Carmody's user avatar
172 votes
11 answers

Is visiting HTTPS websites on a public hotspot secure?

It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
Calmarius's user avatar
  • 1,975
81 votes
10 answers

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
blunders's user avatar
  • 5,072
70 votes
5 answers

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: What exactly is the difference here and why are two encryption bits ...
JohnJ's user avatar
  • 867
28 votes
4 answers

How do the processes for digital certificates, signatures and ssl work?

I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication. Server has a digital certificate acquired from a CA. It also has public and ...
John Eipe's user avatar
  • 423
25 votes
3 answers

Why is faking SSL certificate difficult?

In the news that comes from Iran, you hear that Iran has succeeded in making fake ssl certificates, so that they can find people's gmail account credentials. Some analysts are saying this is possible ...
user893730's user avatar
4 votes
3 answers

Public key in SSL protocol

I have gone through many of the posts including My understanding of how HTTPS works (gmail for example). Everywhere it's mentioning that before creating a https connection, the browser verifies the ...
kevin's user avatar
  • 63
4 votes
1 answer

Purpose of certificates signed and trusted by CA

Another newbie question but I just don't get the purpose of certificates signed and trusted by CA. We already have public/private keys, hash functions to sign/encrypt messages so why do we need ...
Cemre's user avatar
  • 315
5 votes
1 answer

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
Randall's user avatar
  • 151
2 votes
2 answers

What number of bits does a browser use to generate a key?

The question comes from the accepted answer in this thread: My understanding of how HTTPS works (gmail for example) The Gmail server sends your client a certificate. The certificate includes the ...
JohnJ's user avatar
  • 867