Web Design Hull :: Web Design UK :: DRS Design - web design for Hull and the UK

About secure server connections, https and SSL

Secure connections

Sometimes it's very important to make sure that the information you transmit over the internet is secure. For example, if you are buying something using your credit card details, or sending sensitive information that you do not want just anyone to be able to read.

For those situations where secure connection between your computer and a website is important to you, look for the following in your web browser:

Look for https:// when security matters to you

With an https connection, any data transferred between your computer and the website is encrypted in transit, which makes it completely unreadable even if it is intercepted.

If a url begins with http:// the connection is NOT secure!

For the majority of most people's web browsing there is no problem with using http://, in fact it is faster than an https:// connection. But it is not appropriate to offer people an http:// connection when asking them to submit highly confidential information such as credit card numbers etc.

Whenever you send information to a website, the information you send is never sent directly to that site, instead it passes through a series of hops, known as IP addresses, and in some cases there could be quite a large number of these between your computer and the website. These hops will be under the control of various different organisations, starting with your ISP, and also including Telecom companies, IT companies, etc. Staff at these places have access to these hops, plus there is the risk of access by persons not authorised, in other words hackers.

An example of just how many different hops your data may be travelling through...

It is possible to run a utility called a trace route program to discover the hops between your computer and the website you want to connect to. Below is an example of a trace route result. The connection was between a computer connected to the Internet in Hull and the site 'www.hotmail.co.uk':

You might have thought that connecting to a .co.uk site from within the UK would mean the data would not be travelling far, but as you can see there are at least 15 hops (and more beyond San Jose that can't be traced). The route starts in Hull, and then goes to Manchester, London, crossing the Atlantic to New York, then Chicago, Denver, San Jose. At San Jose it appears to hit a firewall and the remaining hops cannot be identified.

If you send any information to a website that is using a standard http:// connection (for example, credit card numbers, personal details, posting to a web forum, etc) then everything you send travels across the Internet in openly readable text. It could be read by anyone with access to any of the hops who knows how to.

If you are logging in to a restricted area, and the log in page is itself on a standard http:// connection, then your username and password will travel across the Internet in openly readable text and, again, anyone (with the access and skill) can intercept them.

Unsecured wireless broadband routers - an additional concern

Using http for websites collecting sensitive data is subject to an additional concern - unsecured wireless routers. Many people are now enabling their own homes to be wireless enabled wi-fi zones. The advantage to the home user is that if you want to connect to the Internet you don't have to physically plug in to a socket, just use the wireless capability of your laptop, notebook pc, etc, and go online with a wireless connection from anywhere in your house.

Wireless connections can potentially be set up as secure connections between your computer and your wireless router, but the majority of home users are not IT specialists and do not always know how to make the wireless connection secure, nor do many understand the implications of not making it secure.

Watch a BBC news item about unsecured wireless access

If you are using an unsecured wireless connection, and are viewing http sites, then it is very easy for anyone in the neighbourhood with a laptop, the right software, and the skill to know how to do it, to snoop on everything you do online and also to intercept any data you send.

If you are running a website that collects information that you want to keep private, then you should be aware that some of your users may be on a wide-open wireless connection, with the result that all of the infomation submitted to your site could be accessed by someone who got in because they were able to snoop on a single unsecured wireless user. If you were using an https connection this couldn't happen as the data would be encrypted between the user's computer and your website, even if the wireless connection is not secure.

From Amazon UK:
Colossus: Bletchley Park's Last Secret
Colossus: The Secrets of Bletchley Park's Code-breaking Computers
Enigma [DVD] - the film of the book starring Kate Winslet
Enigma [Paperback] - the novel by Robert Harris

How do secure connections work?

Using secret codes to protect information is known as cryptography, and it's been around in various forms for thousands of years. Nowdays, because computers are so good at number-crunching and can process millions of calculations in a very short space of time, computers have made it possible to create codes that are virtually unbreakable.

When you want to send information securely from your computer to a website, then you need a secure connection. A secure server connection is commonly achieved using what's called Secure Sockets Layer (SSL) and HyperText Transfer Protocol Secure (https). Below is a simplified explanation of how this works.

1: Shared keys

Turning a readable message into a coded one that cannot be read involves the use of a key.

A simple shared key
In the simple example below, A wants to send a coded message to B. The message is 'hello', and the key used is a simple one: A=1, B=2, C=3, etc.

This key is obviously a really easy one to guess, so this is far from secure, but the principle illustrated is that A and B share the same key which they both use in order to encrypt the message (turn it into code) and also to decrypt it (make it readable again).

Complex shared keys
It is possible for computers to use very large numbers and algorithms in order to create keys that are impossible to work out (a little bit like the 'answers' in those premium rate phone-in TV quiz shows...). But in order to securely share encrypted information:

A and B must both know what the key is
The key must be a secret known only to A and B

Over the Internet this creates a problem: how can two computers, A and B, both share a key known only to them? If A creates a key and then sends the key to B, the key could be intercepted in transit, which means any information encrypted by A could be decrypted not only by B, but also by anyone who has intercepted the shared key.

What is required is a way of A being able to create a key, and then of being able to somehow encrypt the key itself before sending the key to B, so that only B can then use the shared key to decode any further messages from A, without the risk of anyone else also being able to decode the messages.

The solution lies in the use of public keys and private keys.

2: Public keys and private keys

Cryptography has developed a way of using two different, but linked keys, known as public and private keys. A public key can only be used to encrypt information; in order to decrypt it and make it readable again you need to have the corresponding private key.

Using the Public Key and Private Key system it is possible for a computer to create a complex key, then encrypt that key with another computer's Public Key and send the encrypted key to the other computer, with the result that only the other computer will be able to decrypt the complex key. The complex key has now become a shared key known only to those two computers, enabling messages to be sent back and forth between the two computers in code, making them completely unreadable to anyone else if intercepted in transit.

The process of establishing a secure connection is entirely automatic, all the user has to do is visit a url that begins with https for the process to begin.

Here's a simplified example of how this works. The example shown sacrifices some accuracy for the sake of simplicity of illustration, but hopefully it will give you a general idea of how a secure connection is possible:

Computers A and B now share a key, which is known only to them. At the end of the session, the key is destroyed - if there are any further sessions between computers A and B then the whole process is repeated and a new key is created and shared. Private keys are never shared or given out, which is why only Computer B can decrypt the message from A and discover what the complex key is that A has created for the purpose of being a shared key between them.

3: Certificates

There is an additional element to the above though - how does computer A know that the computer claiming to be B really is computer B, and not an impostor? This is where certificates come in.

When a certificate is issued by a known and trusted third party then the certificate enables computer A to know that the computer (or website) claiming to be B really is computer B (or website B).

Different web browsers offer different ways of checking the certificate information, below is an example from Internet Explorer 7 of the information you can check if you click on the padlock icon in the browser.