2

This really bothers me a long time,

because.. to encrypt / decrypt data you first need to send a encryption key / decryption key (on an unencrypted connection) to the computer you are comunicating with, right?

If a hacker captures that key HTTPS is useless.. or not? Or am I thinking the wrong way?

I've done extensive research for my school subjects at this but just can't find enough information to answer my questions.

Improve this question
4
  • 1
    I think you should further into public/private keys. The public key is "public", meaning anyone can have it, it can only be used to decrypt what the private key encrypted. So if the server sends a String, and an encrypted version of the string, you use the public certificate to decrypt the encrypted version. If the result matches the string, you know the server had the private key and he is who he says he is.
    – Konerak
    Feb 27, 2013 at 8:28
  • Now your question would be "Yeah sure, but since the server sends you his public key too, any impostor could just send an other public key to which he has the private key?" Now that's where the Root Authority comes into play: the public key is signed by a higher power which guarantees that key belongs to that site. But doesn't this just put the problem at a higher level? How do you know the higher authority is to be trusted? Ah, these higher authorities come with your browser when you install it, and are kept up to date with browser updates.
    – Konerak
    Feb 27, 2013 at 8:34
  • Also, rather than on superuser, this question might belong on security.stackexchange.com (which you might find an interesting read anyway).
    – Konerak
    Feb 27, 2013 at 8:36
  • 1
    Try this: security.stackexchange.com/questions/20803/how-does-ssl-work
    – Andrew Ferrier
    Feb 27, 2013 at 10:17

1 Answer 1

Reset to default
3

Any private keys are not send. HTTPS is based on trusted certificates. All web browsers have a list of trusted certificate issuers. Server sends it's certificate and it is checked against this list. After that client gives only it's public key which server uses to encrypt data. Data can be only decrypted with clients private key.

SSL connection

Improve this answer

You must log in to answer this question.