What the HTTPS padlock means: how your browser talks in secret on a Wi-Fi anyone can read
Public Wi-Fi: what a stranger on the same network can read
A Wi-Fi with no password sends the messages of your phone through the air. Anyone nearby can catch them. What can a stranger at the next table really read?
-
1
Miva has found the right pair of shoes and pays for them on her phone, over the free Wi-Fi of a café. At the next table, Rono opens his laptop on the same Wi-Fi.
-
2
Her phone doesn't send the order in one piece. It cuts it into small messages, called packets, and sends them through the air to the café's router. On a Wi-Fi with no password, the air carries each one to every device in range.
-
3
Rono's laptop only has to listen: a free program keeps a copy of every packet it hears. If the shop used plain HTTP, the rules of the web with no lock, each copy would read like a postcard, card number included.
-
4
This happened for real. In 2010, a free add-on called Firesheep let anyone on a café Wi-Fi click a name in a list and enter the accounts of the people around them, on sites that used plain HTTP after sign-in.
-
5
Today, Miva's shop starts with https, and her browser shows a padlock. Rono's laptop still catches every packet she sends. Each one now reads like this.
-
Go further
Two more things worth knowing.