How HTTPS works – Explained in layman terms

Yeah. My ISP is doing exactly that. HTML pages over HTTP are injected with some javascript code. Sadly, it's the only ISP available in the entire country.

Ack. I will rectify HTTPS to HTTPs. While writing I had the same doubt.

It's TLS certificate now. In the next article, I'll be adding a small note on the history of SSL to TLS.

Thanks Buddy. I have corrected it.

Thanks

This probably doesn't help because in practice that's not how it's done at all.

For a modern HTTPS connection what happens is that two participants use a Key Agreement process which results in them both knowing a random secret that nobody else knows. This secret is ephemeral which means once the connection closes they'll both forget what it was.

They both use this shared secret to choose the same several symmetric keys and use those keys to encrypt (and decrypt) the actual HTTP traffic.

For HTTPS in particular the main asymmetric cryptography is used for signatures, proof that this is really news.ycombinator.com for example. Your web browser doesn't encrypt messages to news.ycombinator.com but after Key Agreement happens the server will send a message proving it participated in this agreement you've just done, signed using its private key, and your browser uses the public key to check that this is a genuine signature.

No, it doesn’t work that way for HTTPS. Public Key Cryptography is a relatively expensive operation. So the public/private keys are used to create and exchange a temporary symmetric encryption key. That symmetric encryption key is used to encrypt and decrypt the HTTPS requests and responses later by the client and the server.

What you describe is used that way when you want to send, say encrypted emails to someone else when you have their public key.

Peer nodes on a local network can see all messages, even those not addressed to them, since the common model is broadcasting packets and selectively processing them on each client and ignoring packets intended for others (in promiscuous mode, one can capture packets in the local network from all devices, but those packets may or may not contain encrypted data). I’m not sure about modifying the read packets and sending them across though — that would require a more sophisticated attack on the gateway or router and the sending device, in my understanding, which means it’s no longer a peer but an interceptor sitting in between.

It looks like the site is just static content. The login/register form goes off to a different domain which is TLS secured.

The article is not for the layman but for beginners who are interested in knowing the internals of HTTPS. The explanation is in layman terms. You can find plenty of literature on https online but it's not necessary you would grasp everything in a blink of an eye.