Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This really bothers me a long time,

because.. to encrypt / decrypt data you first need to send a encryption key / decryption key (on an unencrypted connection) to the computer you are comunicating with, right?

If a hacker captures that key HTTPS is useless.. or not? Or am I thinking the wrong way?

I've done extensive research for my school subjects at this but just can't find enough information to answer my questions.

share|improve this question
I think you should further into public/private keys. The public key is "public", meaning anyone can have it, it can only be used to decrypt what the private key encrypted. So if the server sends a String, and an encrypted version of the string, you use the public certificate to decrypt the encrypted version. If the result matches the string, you know the server had the private key and he is who he says he is. – Konerak Feb 27 '13 at 8:28
Now your question would be "Yeah sure, but since the server sends you his public key too, any impostor could just send an other public key to which he has the private key?" Now that's where the Root Authority comes into play: the public key is signed by a higher power which guarantees that key belongs to that site. But doesn't this just put the problem at a higher level? How do you know the higher authority is to be trusted? Ah, these higher authorities come with your browser when you install it, and are kept up to date with browser updates. – Konerak Feb 27 '13 at 8:34
Also, rather than on superuser, this question might belong on (which you might find an interesting read anyway). – Konerak Feb 27 '13 at 8:36
up vote 3 down vote accepted

Any private keys are not send. HTTPS is based on trusted certificates. All web browsers have a list of trusted certificate issuers. Server sends it's certificate and it is checked against this list. After that client gives only it's public key which server uses to encrypt data. Data can be only decrypted with clients private key.

SSL connection

share|improve this answer

You must log in to answer this question.