What is the difference between http and https?

I wish to know the difference between http and https, and why is https recommended over http these days?  We students specially in 11 & 12 class come across various terms like http and https.

All I know is the full form of http - hyper text transfer protocol. But, what is difference between http and https?

That is if we add "s" to http what difference does it make?

Posted in: #Hacking and Security

HTTP(Hpertext Transfer Protocol) is a protocol used in application layer for transmitting and retrieving information across internet.Http request could be sent and you get a response for that..

HTTPS(hypertext Transfer Protocol Secure) works by transmitting normal http interactions through an encrypted system and the information cannot be accessed by any party other than the client and end server. Two types of encryption layer available are Transport Layer Security (TLS) and Secure Sockets Layer (SSL), both of which encode the data records being exchanged.

Default Port number for HTTP is 80 and for HTTPS it is 443..

miniy

HTTP(Hpertext Transfer Protocol) is a protocol used in application layer for transmitting and retrieving information across internet.Http request could be sent and you get a response for that..

HTTPS(hypertext Transfer Protocol Secure) works by transmitting normal http interactions through an encrypted system and the information cannot be accessed by any party other than the client and end server. Two types of encryption layer available are Transport Layer Security (TLS) and Secure Sockets Layer (SSL), both of which encode the data records being exchanged.

Default Port number for HTTP is 80 and for HTTPS it is 443..

Thanks miny. Nice information

thanks miniy good information.😎

@miny
Very nice info but m having some doubt..please clarify it
How does the receiver know which of the two (SSL or TLS) encyrption is used ?

@bluderboy, the unique ports used will tell the reciever or server whether its HTTP-port 80 or HTTPS-port 443. This ports are unique and consistent. The also separate services such as mail, DNS and other applications and are used for managing sessions. You should read more on ports

and please wat difference both makes if we use them.........................

ya, that i got...............so why isn't it dat https should b mostly used??? plz enumerate all the differences on d basis of use n limitations n all............

lovejeet

ya, that i got...............so why isn't it dat https should b mostly used??? plz enumerate all the differences on d basis of use n limitations n all............

Since it is one of the most important questions that has been left unanswered, I thought I should list down my answer here.

If you want the short point-by-point answer, here we go -

HTTP (or Hyper Text Transfer Protocol)

1. It is an unsecured connection.
2. There is no encryption.
3. No certificates are required.
4. The website URL begins with https://
5. It uses port 80 for communication.
6. Operates at Application Layer of the OSI network model.

HTTPS (or Hyper Text Transfer Protocol Secure)

1. It is an secured connection.
2. It is an encrypted connection.
3. No certificates are required.
4. URL begins with “https://”
5. It uses port 443 for communication
6. Operates at Transport Layer of the OSI network model.

If you want the long answer, read on -

HTTP is the name of the protocol used to send & receive information over the internet. It turns out that when thousands of websites were getting built on the internet, many website owners wanted to exchange confidential information across different websites through a server. With HTTP protocol information would be accessed without secure authorisation. Therefore, Netscape corporation decided to create HTTPS, the secure version of HTTP to allow authorisation and secured transactions.

HTTPS is a lot similar to HTTP as it follows the same basic protocols. They operate by a website URL sending information request to server which then responds with the status and a message. The status could be positive or negative depending upon the request.

Since HTTP or HTTPS is a part of the URL, the form of request changes. If HTTPS is used instead of HTTP in a URL, the server knows that an 'encrypted' connection is being requested.

HTTPS connection is typically desired in following scenarios:
1. Log-in pages of websites
2. Secure banking related transacations
3. Corporate log-ins
4. Websites where confidential information is exchanged between users and admin etc.

Http and Https both are the part of Url, and its uses the same protocol. The only difference between them is https is secured as the data requested or sent is in "ENCRYPTED".

Start wireshark, tcpdump, or whatever packet capture tool you have access to and capture some packet transfers for https://somedomain (which will use port 80) and https://somedomain (which will use port 443).

You will see the content using https:// (port 443) is all encrypted.

HTTP stands for Hypertext Transfer Protocol. This protocol allows communication between different systems. When you type any web address, your browser acts as a client and the computer act as a server. HTTP uses TCP (Transmission Control Protocol), generally over port 80, to send and receive data packets over the web.
How it functions?
The client sends a request message to a HTTP server which hosts a website, the server then replies with the response message that contains completion status information, such as “HTTP/1.1 200 OK”.

HTTPS stands for Hypertext Transfer Protocol Secure. This protocol allows a secure communication between different systems. It encrypts all data during the communication. HTTPS also uses TCP (Transmission Control Protocol) to send and receive data packets, but it does so over port 443, within a connection encrypted by Transport Layer Security (TLS).

This is the awesome website for students like me.

http is a unsecured connection while https is an encrypted secured connection.

Ankita Katdare

Since it is one of the most important questions that has been left unanswered, I thought I should list down my answer here.

If you want the short point-by-point answer, here we go -

HTTP (or Hyper Text Transfer Protocol)

1. It is an unsecured connection.
2. There is no encryption.
3. No certificates are required.
4. The website URL begins with https://
5. It uses port 80 for communication.
6. Operates at Application Layer of the OSI network model.

HTTPS (or Hyper Text Transfer Protocol Secure)

1. It is an secured connection.
2. It is an encrypted connection.
3. No certificates are required.
4. URL begins with “https://”
5. It uses port 443 for communication
6. Operates at Transport Layer of the OSI network model.

If you want the long answer, read on -

HTTP is the name of the protocol used to send & receive information over the internet. It turns out that when thousands of websites were getting built on the internet, many website owners wanted to exchange confidential information across different websites through a server. With HTTP protocol information would be accessed without secure authorisation. Therefore, Netscape corporation decided to create HTTPS, the secure version of HTTP to allow authorisation and secured transactions.

HTTPS is a lot similar to HTTP as it follows the same basic protocols. They operate by a website URL sending information request to server which then responds with the status and a message. The status could be positive or negative depending upon the request.

Since HTTP or HTTPS is a part of the URL, the form of request changes. If HTTPS is used instead of HTTP in a URL, the server knows that an 'encrypted' connection is being requested.

HTTPS connection is typically desired in following scenarios:
1. Log-in pages of websites
2. Secure banking related transacations
3. Corporate log-ins
4. Websites where confidential information is exchanged between users and admin etc.

Minor Correction and adding few additional points:
1. https require certificate . It could be issued by CA (Certificate Authority) or Self Signed.
2.TLS works above the transport layer in the OSI model
3. port 80 and port 443 are default ports for http and https. However you can change the ports at your will (by admin of the website), provided the ports are free.
4. Though https is used for secure communication and was believed to be unbreakable, however there are ways by which the data can be read.In this case the user or victim can be tricked easily so that data can be sniffed.
5. SSLv2 and SSLv3 are broken , so should not be used.

Can we set http and https on same port?

Interesting question, @Radhika . To the best of my knowledge, running http and https on the same port is *not* possible with Apache. I think that's because there's some port-blocking.

However, with NGINX, it's possible to run both http and https on the same port. It is likely to require patching; which I'd not recommend as it creates issues at the time of upgrading the web server.

Here's a solution that I found on the server that seems to work with NGINX:

Add ssl on; and error_page 497 $request_uri; to your server definition.

Give it a try; but don't on a live or production server. You're likely to mess things up. Try this on a local installation and let me know what you observe. It'd be something very interesting. 

Both HTTP(Hyper Text Transfer Protocol) and HTTPS (Hyper Text Transfer Protocol Secure) are used for transmission and retrieval of information over internet with port numbers 80 and 443 respectively. HTTP is a unencrypted protocol whereas HTTPS is a encrypted protocol mean the data transmission through HTTP and HTTPS is through unencrypted and encrypted medium respectively. 

Since large amount of data transmission takes place over internet it has become an open house for multiple data transmissions and transactions which resulted in insecurity. With HTTP any user can fetch or send the data over internet resulting in the data transmitted which is insecured. There comes the encrypted and secure protocol HTTPS for transmission of data. All the Sign In portals make use of HTTPS for the security purpose. 

HTTP stands for Hypertext Transfer Protocol. It is also called a “stateless protocol”. This is due to the fact that each command is executed separately with no reference from the previous run command. It has a set of rules and standards which govern how information is transferred on the World Wide Web. These are standard rules for web browsers & servers to communicate. It is an application layer network protocol built on top of TCP (Transmission Control Protocol). It uses Hypertext structured text. With this, it establishes a logical link between nodes containing text. 

 

HTTPS stands for HyperText Transfer Protocol Secure and is a combination of SSL/TLS protocol and HTTP. It is more advanced and secure than HTTP. Its transactions are secure and encrypted with SSL. Port no. 443 is used for Data Communication. This provides encrypted and secure identification of a network server.

 

Since we are revisiting this old discussion, I'd like to offer an even simpler explanation. 

Let's assume that you are logging into a site (like CrazyEngineers). You choose to login using regular Username and Password. 

When you type your username and password and click 'Login' button, the browser will have to send this data to the server so that we can check if you have entered right password for the username. 

If there is a person sitting in between - keeping a watch on your Internet connection, they can readily look into the string of text that is passing through the connection. 

Now imagine a case where the hacker is observing an Internet connection and they get an encrypted (HTTPS) connection. The password will be 'encrypted', which means a password as simple as "12345" will be turned into a complex string like "w08sfoi34sroijkjsdflkjeslkj". Even if they get to know is encrypted string, they won't be able to figure out the actual password. 

This is one of the simplest advantages of the HTTPS over HTTP. Google has mandated that all the sites on the Internet must use HTTPS over HTTP in order to be eligible to rank in search engines. 

HTTP -

It is hypertext transfer protocol. 

Data is vulnerable to hackers, security is low. 

It uses port 80 by default 

It operates at TCP/IP level. 

HTTP website doesn’t use encryption.   

HTTPS-

It is a hypertext transfer protocol with security. 

It is designed to prevent hackers from accessing critical information. It can defend against this type of attack. 

It was use port 443 by default. 

HTTPS does not have a separate protocol. It runs over HTTP but uses a TLS / SSL encrypted connection. 

HTTPS websites use data encryption.

HTTP stands for hypertext transfer protocol. It's an interface which allows multiple platforms to communicate. Typically, the viewing of web pages is used to transfer data from a web server to a browser.

The issue is that HTTP  information is not encoded and the collection of data exchanged between the two systems can be intercepted by third parties. Using a secure version called HTTPS, where the "S" stands for safe, will fix that.