Web tower · floor

HTTP vs HTTPS: what the padlock does not say

One letter separates them, and it stands for exactly one thing. The trouble is that people read it as standing for something larger — and the company that makes the most-used browser says so on its own help page.

So the honest translation of the two is short. HTTP carries a page between a server and your browser in the open. HTTPS carries the same page inside an encrypted connection, so that, in Google’s words, what you send and receive “is private between you and the site”. The S is a promise about the pipe.

What it is not is a promise about the destination — and browsers have four different things to say on the subject, only one of which is about the site itself.

Reading those four in order shows where the real judgement sits. The first three are all statements about the connection: private, not private, or something wrong with it. Only Dangerous is a statement about the site — and Google is explicit that it comes from Safe Browsing, a separate system that flags sites, rather than from anything the certificate proves.

That distinction matters more than it sounds. A certificate is not a character reference. It shows that the connection to a particular name is encrypted; it does not investigate who registered that name or what they intend to do. Which is exactly why Google’s advice on a secure page is not “relax” but “check the site name in the address bar” — the name is the part a certificate cannot vouch for on your behalf.

For a page without HTTPS, Google’s advice is plain: “We suggest you don’t enter any private or personal information on this page. If possible, don’t use the site.” Note what it does not say — it does not tell you to fix anything, because there is nothing on your side to fix.

The setting that asks first. Chrome has an option called Always use secure connections. Google describes what it does plainly: with it on, “if a site doesn’t support HTTPS, Chrome displays a ‘Connection is not secure’ warning”. So instead of quietly loading an unencrypted page, the browser stops and asks. For anybody who would rather be told than assume, that is the one switch on this page worth changing — and it changes the default from silence to a question.

There is one more thing worth knowing about what the icons do and do not tell you, and Google mentions it in passing. Selecting the symbol opens “a summary of the site’s privacy details, cookies and site data, permissions, history of visits, and information about the page”. The icon is a door as well as a status — and behind it is the list of what that site has been allowed to do on your machine, which is a more useful thing to read than the icon itself.

What this page will not tell you is that HTTPS makes a site trustworthy. That is the specific confusion it exists to correct, and repeating it in softer words would defeat the purpose. Encrypted and honest are two different properties, checked by two different mechanisms, and only one of them is reported by a padlock.

Nor will it tell you how to get a certificate for your own site — that belongs to the floors on hosting and domains, where the practical arrangements live.

The floors below take it three ways: what the connection protects, what it does not, and the neighbouring things a browser reports about a page.

What this tower will not do

It will not tell you a padlock means a site is trustworthy. Google prints a warning to keep checking the address directly beneath its own description of the secure indicator.

It will not treat the four browser states as four grades of safety. Three of them describe the connection and one describes the site, and they are not on the same scale.

And it will not tell you to work around a “not secure” warning. Google says the site owner is the one who has to fix it, and that there is nothing to enter on such a page in the meantime. What holds instead is simple: the descriptions of the secure, not private, not secure and dangerous states, the instruction to check the site name in the address bar even on a secure connection, the note that someone may view and change information sent over an unsecured connection, the statement that the site owner must secure the site with HTTPS, the advice not to enter personal information on an unsecured page, the Always use secure connections setting and its warning, and the summary of privacy details available behind the icon are quoted from Google’s Chrome help documentation, listed below.