Plain HTTP and why it's unsafe
Networking series · Part 2 of 4
In Part 1 we saw that a web request is plain text, handed across many machines you don't control. Now let's see what a stranger on that path can actually do. You'll play the stranger.
Imagine you're at a café, on its free Wi‑Fi, using http://mybank.com (plain HTTP, no s). Someone else is sitting on the same network with a laptop.
Attack 1: reading (eavesdropping)
Here's a login form. Type anything and press Send. The right side shows what the person on the café Wi‑Fi sees.
👤 You, in the browser
🕵️ Stranger on the same Wi‑Fi
No hacking skill needed. Free tools (Wireshark, tcpdump) show this on any network you share. Password, cookies, messages, all readable. Remember the Cookie: session=… line from Part 1? Steal it and you're logged in as that person, without ever knowing their password.
Attack 2: changing (tampering)
Reading is bad. Changing is worse. You're sending a payment. Switch the stranger on, then press Send.
📤 What you sent
🏦 What the bank received
Neither side can tell. Over plain HTTP nothing checks that the message arrived unchanged. This also happens to web pages: some networks inject ads or tracking scripts into pages you load over HTTP.
Attack 3: pretending (impersonating)
A stranger can also set up a fake Wi‑Fi called "Cafe Free WiFi" and send you a copy of the bank's page. Two pages below look identical. Both claim to be http://mybank.com. Which one is the real bank?
Page A
http://mybank.com/login
Username ____
Password ____
Page B
http://mybank.com/login
Username ____
Password ____
You can't tell, and neither can your browser. Plain HTTP has no way to prove who is on the other end. (Browsers do label such pages "Not secure" in the address bar.)
Three problems, three promises
Each attack breaks one promise. The fix for all three is HTTPS, which is HTTP wrapped in TLS.
| Attack | What breaks | What TLS promises |
|---|---|---|
| Reading | Privacy | Confidentiality: strangers see only scrambled data. |
| Changing | Trust in the message | Integrity: any change is detected. |
| Pretending | Knowing who you talk to | Authenticity: the server proves its identity. |
To build those three promises we need a few ideas from cryptography: keys, locks and fingerprints. That's Part 3.
See it yourself (safely)
neverssl.com is a site made to stay on plain HTTP, handy for testing:
curl -v http://neverssl.com 2>&1 | head -20You'll see the whole request and response as readable text. Never type real passwords into HTTP sites, and be careful on public Wi‑Fi.