Browsers, HTTPS and How to Check a Website

The web browser is the window through which you do your banking, shopping, studying and socializing. It is also the place where most phishing attacks end up, on a page that looks right but is not. In this lesson you will learn what the padlock really means, how to read a web address, and how to run a quick check on any site before trusting it.

Your devices are now updated, locked and backed up. In this chapter we follow your data out onto the internet, starting with the program that does most of the talking: the browser.

What happens when you open a website

When you type an address or click a link, your browser contacts a server somewhere in the world, asks for a page, and displays what it receives. In the early days of the web, this conversation was written in plain text, so anyone on the path (a shared Wi-Fi owner, an internet provider, an attacker) could read or alter it, like a postcard passing through many hands.

HTTPS (the "S" stands for "secure") wraps this conversation in encryption, an idea you met with disk encryption. With HTTPS:

• The content exchanged is encrypted: people on the path see that you are connecting to a site, but not the pages, the forms or the passwords.
• The browser checks that the site holds a certificate issued by a trusted authority, which proves that the site genuinely controls that address.
• The content cannot be modified on the way without detection.

If you want the technical details later, the documentation on developer.mozilla.org explains HTTPS and certificates well; you will also study them in the next course of this learning path.

What the padlock does and does not tell you

For years, people were taught "look for the padlock". Today that advice is incomplete, and sometimes misleading. Nearly all websites, including malicious ones, use HTTPS, because obtaining a certificate is easy and often free.

• The padlock means: the connection between you and that address is encrypted, and the certificate matches that address.
• The padlock does not mean: the site is honest, safe, run by the organization you think, or free from malware.

A criminal can register an address like my-bank-secure-login.example, get a certificate and display a perfect padlock. The encryption is real; the destination is fake. So the question to ask is not "is there a padlock?" but "is this really the address I meant to visit?".

Modern browsers also display a warning page when a certificate is invalid or expired, or when the site is on a list of known dangerous sites. Take these warnings seriously. Do not click "proceed anyway" on a site where you would enter a password or a payment card.

Reading a web address

A web address (URL) has several parts, and the important part is smaller than people think. Take this example:

https://login.shop.example.com/account/settings?id=42

1. https:// is the protocol.
2. The domain name is read from right to left and stops at the first slash. Here it is example.com, the last two parts before the first /.
3. login.shop are subdomains, chosen freely by whoever owns the domain.
4. /account/settings?id=42 is the path and parameters, which are irrelevant to the identity of the site.

What matters is the registered domain, just before the first slash. Attackers exploit the confusion:

• https://example.com.account-check.example: the real domain is account-check.example, not example.com.
• https://examp1e.com or https://exarnple.com: lookalike spelling ("1" for "l", "rn" for "m").
• https://example.com-security.example: a hyphen turns it into a different domain.
• Domain extensions that differ (.com versus .net or a less usual one).

Sometimes attackers also use characters from other alphabets that look identical to Latin letters. A password manager helps here: it will not offer your login on a domain that does not match the saved one.

A ten-second checklist for a website

1. How did I arrive? A link in an unsolicited message is a reason to be careful. Better to type the address or use a bookmark.
2. Is the domain what I expect? Read it right to left, up to the first slash.
3. Does my password manager recognize it? If it offers nothing, ask why.
4. Does it ask for something unusual? A shop asking for your bank password, or a "verification" page that wants your card number to "confirm your identity".
5. Does the site look right overall? Missing legal notices, no contact details, prices that are too good to be true, and recently created shops with no history are common signs of a fraudulent shop.

Keeping the browser itself safe

• Keep it updated, as discussed in lesson 3.1. Browsers are the most exposed software on your computer.
• Limit extensions. An extension can see the pages you visit, and sometimes everything you type. Install only a few from reputable publishers and remove those you do not use. An extension that was safe can become dangerous after a change of owner.
• Enable the built-in protection against dangerous sites and downloads, and keep the pop-up blocker on.
• Be careful about saving passwords in the browser if your device is shared or not locked. A password manager is preferable.
• Use separate profiles, for example one for banking and one for everyday browsing, if you like organization. It reduces the amount of data a single site or extension can see.
• Use private (incognito) mode with realistic expectations. It only stops the browser from storing your history and cookies on your device. It does not hide your activity from the sites you visit, your employer, your network or your internet provider.

Downloads and pop-ups

• Beware of pages that say "your browser is out of date" and offer a download: updates come from the browser itself.
• Do not allow websites to send you notifications unless you really want them. Fake alerts that appear as notifications are a common scam delivery system.
• Check the extension of downloaded files. A "document" ending in .exe, .scr or .js is a program, not a document.

Your turn

Exercise. For each address, say what the real domain is, and whether you would trust it as a link to "example.com".

1. https://www.example.com/login
2. https://example.com.verify-login.example/session
3. https://support-example.com/account
4. https://accounts.example.com/signin?next=/home

See a solution

1. The domain is example.com (with the subdomain www). Trustworthy, if you typed it or came from a known bookmark.
2. The domain is verify-login.example. Not trustworthy: the name example.com is only a subdomain used to deceive you.
3. The domain is support-example.com, which is different from example.com. Be suspicious, since anyone can register it.
4. The domain is example.com, with the subdomain accounts. Trustworthy as far as the domain is concerned.

Add to your Security Notebook

Create the heading "4. Browsing and communication". Write your three-point website check (for example: "how did I arrive? real domain? password manager recognizes it?") and list the browser extensions you will remove.

HTTPS protects your connection to a website. In the next lesson we look at what happens when the network itself is untrusted, such as public Wi-Fi, and at what a VPN really does.