Locking it so no one can peek: HTTPS

Someone peeks in the middle

As we saw last lesson,
HTTP is the promise of exchanging request and response.
But that content
passes along the road as plain letters.
Anyone sitting in the middle
can glance over and read it all.
Passwords, card numbers, everything.
It is like mailing a postcard.
Everyone it passes can read it.

Tap the 'middle person' on the road to peek at a plain HTTP message. The secret reads right through.

Now we see it gets peeked at,
because the content lies open on the road.
So how do we stop it?
We cannot block the road or remove the middle person.
The internet passes through many hands by nature.
So we flip the idea.
Make it unreadable even when seen.
We lock the content up.
That is the next story.

Lock it shut

The first step is locking.
Before sending, we scramble the content
so it cannot be made out.
This is called encryption.
The locked content is jumbled letters,
so the middle person sees no meaning.
Only the receiver unlocks it back into the original.
It is like mailing the postcard inside a locked box.
You see the box but not what is inside.

Tap the message to lock it (encrypt). Once locked, the letters are scrambled and the middle person cannot read it.

Locked, the middle person cannot read it.
That is reassuring.
But there is one hard part.
The receiver has to unlock what we locked.
For that, we must hand over the key.
Yet if we send that key along the road,
the middle person takes the key too.
That is like locking it and mailing the key with it.
How do we solve this dilemma?

Share the lock, keep the key

There is a clever trick.
We split the lock from the opening key.
Anyone can take the lock
and snap it shut. We call this the public key.
What it locks opens only with my private key.
So it is fine to scatter the lock on the road.
It can only lock, never open.
If you lock with the lock a receiver sent,
it opens only with that receiver's private key.

The receiver hands out a public key (a lock). Lock with it and send, and only that person's private key opens it. The middle person's key will not.

Now the key dilemma is solved.
We can share the lock freely,
because the opening private key stays in my hand alone.
Even if the middle person grabs the lock,
they can only lock, never unlock.
But one thing still remains.
The other side that handed me the lock,
is it really the site I was looking for?
What if a fake held out the lock?

Check that it is real

The last piece is checking identity.
Along with the lock, the site
also presents a certificate, an ID card.
It is a proof issued by a trusted place.
The receiver looks at that certificate
and confirms, "ah, this really is the site."
A fake site cannot present such a proof.
So when the certificate does not match,
a warning pops up and stops us.

Two sites present certificates. Tap each to check if it is real. The real one passes, the fake one raises a warning.

Now we have it all.
The content is locked so it cannot be read,
the opening private key is mine alone,
and a certificate checks the other side is real.
With these three together,
we are safe even with someone in the middle.
They cannot read it, and a fake is exposed.
The lock icon in the address bar
means exactly that this promise is on.

Let's wrap up

Gathered on one line, it's this.
Plain HTTP is in the clear, so it is all visible in the middle.
HTTPS locks the content (encryption).
The lock, a public key, is handed to anyone,
and what it locks opens only with my private key.
A certificate also checks the other side is real.
So even a card number can be sent with peace of mind.
HTTPS is the final lock on the network journey.

Tap the key points in order to review. (plaintext is peeked → lock it → share the lock, keep the private key → check real by certificate)

This is where the network story ends.
From what a network is,
to packets, finding routes, addresses, reliable delivery,
and now locking it so no one can peek.
We saw all the promises by which
a single small letter crosses the internet
and arrives complete, correct, and safe.
Well done. From now on, when you look at the internet,
you will see the promises behind it.