You are signed in. Close

You are signed out. Close

Thank you. Your subscription has started. Close

Thank you. You will get an email when a new comic comes out. Close

We could not confirm your payment. If you paid, use the link "Sign in" at the bottom of the page. Close

Something went wrong on our side. Please try again in a moment. Close

Previous episode HTTPS encryption: how two strangers agree on a secret key in public

What happens when you type a web address and press Enter

HTTPS certificates: how your browser knows it talks to the real website

Your browser can lock its connection to a website. But a lock does not help if a stranger sits at the other end. How does your browser check that it talks to the real website?

  1. 1 Here is the danger. A machine on the way could answer in place of the server, build one key with your phone and another with the server, and read everything it passes along.your phone?the serverOne key with you,one with the server!

    Here is the danger. A machine on the way could answer in place of the server, build one key with your phone and another with the server, and read everything it passes along.

  2. 2 Asking does not help: that machine can say "I am en.wikipedia.org" in the very same words as the real server. From where your phone stands, the two look exactly alike.your phonethe server?I amen.wikipedia.org.I amen.wikipedia.org.

    Asking does not help: that machine can say "I am en.wikipedia.org" in the very same words as the real server. From where your phone stands, the two look exactly alike.

The rest of this episode is for subscribers

Subscribe to read every premium episode. You can cancel when you want.

Paid yearly: $99 instead of $119.88

Next episode HTTP: what your browser really asks a website, and the status code that answers first

Share this comic

More comics