WHAT IS DIFFERENCE BETWEEN HTTP & HTTPS? FIND OUT HERE WITH MORE DETAILS

How can they be difference? As you can look above are difference ways when http vs https. There are many ways to describe it what are you going to choose between this two.

Now lets begin with more details and information!

You click to check out at an online merchant. Suddenly your browser address bar says HTTPS instead of HTTP. What's going on? Is your credit card information safe?

Good news. Your information is safe. The website you are working with has made sure that no one can steal your information.

Instead of HyperText Transfer Protocol (HTTP), this website uses HyperText Transfer Protocol Secure (HTTPS).

Using HTTPS, the computers agree on a "code" between them, and then they scramble the messages using that "code" so that no one in between can read them. This keeps your information safe from hackers.

They use the "code" on a Secure Sockets Layer (SSL), sometimes called Transport Layer Security (TLS) to send the information back and forth.

How does HTTP work? How is HTTPS different from HTTP? This tutorial will teach you about SSL, HTTP and HTTPS.

Above are short informations to understand difference between HTTP vs HTTPS

&

Below are long details for advance acknowledge

What is HTTPS?

HTTPS are more useful than anything and had been used over a years from many popular and famous web server in the world.

HTTPS or Secure HTTP some may call it is a combination of Hypertext Transfer Protocol (HTTP) with SSL/TLS protocol. Now everything you communicate over HTTPS will be sent and received in encrypted form, which adds the element of safety.

From the image above https are more than anything else to use it for your own sites. Either to use for personal or business. For example PayPal use https to avoid from any hackers that might steal their records and use for bad behaviours. Moreover, by standing with "secured" words, they can't encrypted from our sites that have so many files and information. They will face specials code to access web and instantly will stuck there. Codes are use for blocking any experiences hacker to go through their ways.

As when a client makes a request to the server, the server responds by offering a list of encryption methods. When the client connects to a website via HTTPS, the website encrypts the session with a digital certificate. Secure Sockets Layer or SSL uses a cryptographic system that encrypts data with two keys that is browser and server send each other unique codes which are used for encryption for rest of the talk.

Https is used in many situations, such as log-in pages for banking, forms, corporate logins, and other applications in which data needs to be secured. It is always advised to never enter credit card details on websites that run on HTTP.

Okay lets find out how HTTP can work.

A lot of people end up getting confused when they see two different URL’s one as HTTP and other as HTTPS. So what is the difference between these two? In this post, I will discuss the evolution of HTTP and the difference between HTTP and HTTPS in simple term so that it makes sense quite easily.

What is HTTP

It is always necessary to know something about basics before going to the advanced topics. HTTP stands for HyperText Transfer Protocol. It is the system for transmitting and receiving information across server and the client. The Server is the machine where your website code is placed, and the client is nothing but your browser. HTTP manages the mutual understanding between the server and the client to exchange information or data successfully. The first HTTP had only one method called as GET, which would request a page from the server and the response was an HTML page. The latest version of HTTP defines nine request methods.

If you visit any website you may see the address gets prefixed with HTTP:// this means your browser is now connected to the server using HTTP. Now the HTTP isn’t the safest way to establish a connection, the problem with HTTP though is that it is vulnerable to people who might want to eavesdrop or see what your activity is all about.

This shouldn’t be any concern when you are just browsing any website or just Bing’ing, the problem comes when you are making a financial transaction over Internet. As we all know, Internet is not exactly a safe place. Apart from searching and browsing websites, we need to engage in money transactions, online purchases and secure file transfers. So how do we secure such financial transactions? The answer is HTTPS.

Hope many popular and famous sites change http to https for good environment purpose.

When situations become fierce from humiliating hackers doing. 

From the conclusion above, you can describe whats in your minds now. There are many cyber crime from over a year to attacks and hacks our own social media such as Facebook. From the image above, Facebook is using http that can be anytime attacks by someone else. It happens on our facebook social media around 2013. They use for bad behaviour and update status likes sex talking, sex photo and more. But we're quick attempt to deffend our facebook again when we already know how to get back our own facebook and it really works long ago. They are not going too far, around 4-5 sex photos and 3-4 bad words sex talking. We change our password and recover it back all of our original information and today or another time! We're not going to use any social media that shows http. They are very humiliations and dangerous thing to strike our important files.

Let us introduce you some bonus that we know very well.

Lets say you had seen expired https from any web. We have seen this when entered lk21 sites to get more information how they used their web. How can we describes it? Many people out there asked either it might useful to prevent any stealing info or getting worse situations. Find out below :

Good opinions when use for something else

Self signed certificates are not strictly worse than certificates signed by a reputable CA, and in all technical ways they are better than plain HTTP.

From the signing and encryption perspective they are identical. Both can sign and encrypt traffic so that it is not feasible for others to snoop or make modifications.

The difference is the way that the certificate is designated as trusted. With a CA signed certificate the user is trusting the set of trusted CAs that they have installed in their browser/OS. If they see a certificate signed by one of these they accept it and everything is fine. If it isn't (such as when self-signed) you get a big scary warning.

The reason this warning is displayed for self-signed certificates is that the browser has no idea who controls the certificate. The CAs that the browser trusts are known for verifying that they only sign the certificates of the web site owner. Therefore the browser, through extension trusts that the certificate's corresponding private key is controlled by the web site operator (and hopefully it is). With a self-signed certificate the browser has no way of knowing if the certificate was generated by the web site owner, or some man in the middle that wants to read your traffic. To be on the safe side, the browser rejects the certificate unless it is proven valid...and you get a big red warning.

The important thing about this warning is that it gives you a way to get information about the certificate. If you know what certificate you expected to get you can trust that certificate, and your browser will let you connect quite happily. This is of course great if you know the certificate you expect to get. It allows you to not even trust any CA (any trusted CA could generate a trusted certificate and intercept your traffic if they wanted to) if you want.

If you don't verify the certificate you are gaining nothing over unencrypted HTTP as anyone between you and the server could just generate their own certificate and you would be none the wiser. This could be considered worse than plain HTTP as us humans with our feeble emotions might be mislead into thinking that our connection is secure, but the only technical downside over HTTP is some wasted CPU cycles.

So for a private site, which only a couple of people access and you can distribute the certificate a self-signed is actually better than a trusted certificate. However, for the public internet you can't expect the users to verify the certificate (how would you securely transmit the details anyways) and if wise they would probably turn and run.

As for expired certificates they aren't really worse than valid ones. The reason certificates expire is so that they are invalid by the time that cracking them becomes feasible (hopefully). So the difference between a certificate that expires tomorrow and one that expired yesterday is negligible. However I would be more than a little concerned about a certificate that expired years ago.

Opportunistic Encryption

If you want to provide a little extra security there is a new standard (that is only implemented in Firefox at the moment).

Opportunistic encryption provides encryption between supporting clients and servers without authentication. It allows you to use a self-signed certificate without generating any warnings.

The reason why opportunistic encryption is better then using a self-signed certificate and HTTPS is that it provides no suggestion to the user that the connection is secure. To a user the connection appears to be a regular unencrypted HTTP connection but under the hood an SSL connection is being used to thwart passive attackers.

Again, if you are actually verifying the self-signed SSL certificate that is the best. But if you are just trying to provide unauthenticated encryption to stop traffic sniffing opportunistic encryption provides the upsides without tricking the user into thinking they are using a secure connection.

Bad opinions when someone else trying to avoid it from happens to them

I consider that a self-signed and/or expired HTTPS certificates (that raise a warning in the browser) are worse than just using HTTP for the following reason:

When a user is browsing with HTTPS, he/she presumes that it is secure and then the website should return a valid certificate. If it is not the case (self-signed and/or expired HTTPS certificate) then it is not secure. It could be a real threat or a simple problem in the certificate configuration/deployment but still, it is a problem and the user should stop browsing if he/she don’t have more information about this site.

However, there is a situation, in which I found myself today, where a user have more information about the website. Let imagine a small company in which only two employees need to access a website administration platform. If those two employees are aware that the platform does not have a certificate signed by any CAs (Certification Authorities), it is still better to communicate through this unsecured HTTPS than through unsecured HTTP because, at least, the communication is cyphered. Doing this would reduce the attack possibilities even if it does not prevent it.

That said, even if today HTTPS certificate can be delivered freely and quickly, it would have been great, at the time of costly certificates, to have an intermediary protocol between HTTP and HTTPS. A not-less-secure-protocol-than-HTTP where there is no authentication like SSL certificates but where the data is cyphered.

In a nutshell, you can choose either it good for you to use it or vice-versa. You must be careful to consider it in difference ways to use for your own purpose. Hope this can be helpful information for you out there when design your own sites.

Thank you and sorry if grammar wrong and spelling mistakes. Hope you can understand very well.