DEMO: Secure Web Browsing

The number of hackers and scammers has grown a lot over the years, and so it's become more important now than ever that we protect ourselves. One of the ways that we're really vulnerable is when we're online, so let's go over how to secure our web browsing and make sure that we remain safe.

Three Questions

If we have a user and they're connecting to a website, there's a few questions we have. Number one, how do we know we're connected to the right site? Number two, how do we know that there isn't somewhere in between that's eavesdropping on our conversation — that's looking up, let's say we're connecting to a bank site, that's looking up our passwords, looking up our balance and starting to scam us? And then three, that there isn't information changing as it comes back to us, that a scammer isn't changing the information that we're seeing.

PKI and TLS

The first thing to know is that there's a lot going on here to secure that communication and make sure we're connecting to the right site. However, two of them that I'm going to call out here is public key infrastructure, which is an infrastructure that helps secure our communication and make sure we're connected to the right location, and transport layer security, which is a protocol, the way in which we communicate. Those two work together in order to provide some secure communication for us.

The things that it provides are, number one, authenticity. Authenticity is so that way we know the traffic that's reaching us, that's getting to us, is actually coming from the right source — it's authentic. Then we have confidentiality, that somebody in between is not able to look at this information and see what communication is going back and forth. And also integrity, that the information is not changing en route, and so what we're seeing is something that wasn't sent from the original source. So PKI and TLS help implement these aspects to make sure we're practicing secure web browsing.

I go way more in depth into this in a whole course — that's beyond the scope of this lesson and this course. But what it really revolves around is some sort of trust. We trust something, and in this case we call it a certificate authority. We trust this certificate authority, and because we trust this certificate authority, anybody that that certificate authority approves of, then we trust them.

It also involves encryption. We encrypt things with a public key and a private key, and when information comes to us we can decrypt this traffic using the public key. If it successfully decrypts, we know it's been encrypted with this private key. That gives us a certain amount of authenticity that it came from the correct site and that it has been approved of from this certificate authority.

Certificates

A lot of this comes into play through what we call certificates. Certificates have the name of the site. It has the trusted entity here, the certificate authority, which is going to be in association with what I have here — the certificate authority that gives trust to this entity right here, or in this case right here it's techknowsurge.com, as what our example is. And so then we also have on this certificate the public key and several other pieces of information, and a little thumbprint of what this certificate looks like — we call it a hash, a hash of the certificate.

There's a lot more to this, but it ends up getting encrypted by the certificate authority, and that's part of the proof of the certificate and that the certificate is actually valid. Essentially that's what all happens: we need to validate this certificate, and once we validate the certificate, then that will validate this traffic coming across there, making sure that it's coming from the right source.

Looking at a Secure Site

Let's jump on the browser and see what this looks like. What I'm going to do is go to techknowsurge.com and hit enter. This pops up here, and we can see that we can view more information, view site information — it's just to the left of this URL.

So I see the URL, techknowsurge.com. If I'm really careful, what I could do is check to make sure that this is the site I wanted to go to and it's not been redirected anywhere else. Then I can click on the details to verify that this site is secure. It says connection is secure, so we're good to go there. I can find out more information about this by clicking on it. So here is connection is secure, and it's got information around this connection: certificate is valid.

I can open this up and we can see details about this. This is given to techknowsurge.com, so this lines up with this URL that I went to, so that's good. And the common name — or excuse me, the issued by — is R11 Let's Encrypt. This is the organization, this is the certificate authority that validated me, this is the one that the computer trusts, this R11 Let's Encrypt. Because it trusts that, and R11 trusts techknowsurge.com, therefore this computer now trusts techknowsurge.com.

Then we can see the validation period. We see the start of the validation period and where it's going to go to, and so we've got this date range that it's validated with. That's going to be important, because we don't want to go to sites that don't have a valid certificate.

Then we've got the key. This is the actual key that we have for encrypting the traffic — or in this case actually decrypting the traffic. So there's the public key right there. And then we've got some other details; we can actually dig down into further details. But this is the certificate that says yes, this site is trusted and secure. When we say secure, both secure from an integrity standpoint, that it hasn't been changed along the way, but also secure in that no one has eavesdropped on it. So I have a certain amount of authenticity with this, that it's coming from the correct site, plus confidentiality and integrity.

An Insecure Example

Let's take a look at an example of something that's not secure. What I'm going to do is click in here and go to — this is a piece of equipment that's on my network here — and I go to it and notice that the HTTP is crossed out. It says that it's not secure. I can click on this: your connection to the site is not secure.

So this is a concern of mine. I wouldn't want to proceed to the site unless I know exactly why this is not secure. I can open this up and it's got some details, what it's issued by. So it's got a certificate, it's just that the certificate is issued by itself, essentially, is what it is, and so it doesn't like this certificate because of that.

If I want to proceed to this, I can click on advance and proceed, but beforehand I better be sure that I'm connecting to the right device here. I say device because that's what I'm connecting to. I wouldn't ever go to a site that I've never been to before and just accept this. At this point in time I'd close out of this and not continue to that site. But because I know exactly what piece of equipment this is, I can click on advance and then proceed to the site, knowing that I'm the one who set this up and I set it up to not have a certificate that's valid on it. So I would feel safe going to the site.

If You Administer the Site

Now, this is really dangerous if you're administering a site or connecting to a site. If you are in charge of the site, you don't ever want your users to have to go through this process, because you don't ever want to desensitize them to these messages. That would be a bad thing to have happen. So I wouldn't set up any kind of end-user device that my end users are going to with something like this. I'd make sure I have a valid certificate — whether I have to pay for that valid certificate or find a free source for that valid certificate.