4.2: Encryption in Transit, Plainly

Encryption in Transit, Plainly

Lesson 4.1 covered data sitting on your devices. This one covers data in motion, and it exists mainly to correct two expensive misunderstandings: what the browser padlock means, and what a VPN does.

What the padlock promises

The padlock in your address bar — HTTPS — means the connection between your browser and the website is encrypted. Nobody between you and the site (the coffee shop’s Wi-Fi, your internet provider, anyone lurking on the network) can read what you send or tamper with what comes back. That’s real protection, and it now covers well over ninety percent of web traffic.

Here’s the misunderstanding, and it’s the one phishing sites exploit: the padlock says the conversation is private. It says nothing about who you’re talking to. A scam site gets HTTPS as easily as your bank does, since certificates are free and automatic. paypa1-secure.com will happily show you a padlock while it privately, securely steals your password. The padlock rules out eavesdroppers; it never vouches for the other end. Your password manager’s autofill judges the who (Lesson 2.3). The padlock only ever judged the how.

End-to-end, versus readable by the provider

One more distinction worth having. HTTPS protects the road between you and the company’s servers, but once your message arrives, the company can usually read it. Ordinary email and SMS work this way: encrypted in transit, readable at rest by the provider, and by anyone who compromises or subpoenas the provider.

End-to-end encryption moves the locks to the endpoints. Only the sender’s and recipient’s devices hold the keys; the company in the middle carries sealed envelopes it can’t open. Signal works this way for everything. iMessage does between Apple devices (blue bubbles — green means SMS, which doesn’t). WhatsApp does for message content. A reasonable rule of thumb: for anything you’d mind the provider, or an attacker inside the provider, being able to read, prefer an end-to-end messenger over SMS or email.

The VPN question, answered straight

You’ve seen the ads: hackers on public Wi-Fi are stealing your passwords, and a VPN is the shield. What the ads skip is that HTTPS already fixed most of that, years ago. The coffee-shop attacker reading unencrypted traffic was a real threat in 2010. Today, with the padlock on nearly everything, that attacker can see which sites you visit, but not your passwords, messages, or card numbers, which ride inside HTTPS no matter whose Wi-Fi you’re on. For ordinary use, public Wi-Fi is mostly fine now.

What a VPN really does is encrypt your traffic to the VPN company’s servers, hiding which sites you visit from the local network and your internet provider — and showing all of it to the VPN company instead. You’re not eliminating a middleman. You’re choosing one. That trade is worth making in some situations: you don’t trust the network operator or the ISP itself (certain countries, certain hotels), you need to appear to be somewhere else, or your employer requires one for work systems. What it doesn’t do: stop phishing, stop credential stuffing, protect leaked passwords, or make you anonymous. Every threat this course has shown you so far operates entirely unbothered by a VPN.

No product recommendations here, on purpose. Most people reading this don’t need one, and the fear the ads sell is about a decade out of date.

The takeaway

Transit encryption is the one layer you mostly get for free. The padlock guards the road, end-to-end guards the destination, and your judgment — trained in Modules 2 and 3 — guards the who. Next lesson: the layer that forgives every mistake the others can’t.