1. Home >
  2. Apps >
  3. Groups >

What is the difference between http and https?

Question asked by safwan in #Hacking and Security on Mar 5, 2009
safwan
safwan · Mar 5, 2009
Rank B2 - LEADER

I wish to know the difference between http and https, and why is https recommended over http these days?  We students specially in 11 & 12 class come across various terms like http and https.

All I know is the full form of http - hyper text transfer protocol. But, what is difference between http and https?

That is if we add "s" to http what difference does it make?

Posted in: #Hacking and Security
Yamini L
Yamini L · Mar 5, 2009
Rank C2 - EXPERT
HTTP(Hpertext Transfer Protocol) is a protocol used in application layer for transmitting and retrieving information across internet.Http request could be sent and you get a response for that..

HTTPS(hypertext Transfer Protocol Secure) works by transmitting normal http interactions through an encrypted system and the information cannot be accessed by any party other than the client and end server. Two types of encryption layer available are Transport Layer Security (TLS) and Secure Sockets Layer (SSL), both of which encode the data records being exchanged.

Default Port number for HTTP is 80 and for HTTPS it is 443..
zia.sepsis
zia.sepsis · Mar 5, 2009
Rank C3 - EXPERT
miniy
HTTP(Hpertext Transfer Protocol) is a protocol used in application layer for transmitting and retrieving information across internet.Http request could be sent and you get a response for that..

HTTPS(hypertext Transfer Protocol Secure) works by transmitting normal http interactions through an encrypted system and the information cannot be accessed by any party other than the client and end server. Two types of encryption layer available are Transport Layer Security (TLS) and Secure Sockets Layer (SSL), both of which encode the data records being exchanged.

Default Port number for HTTP is 80 and for HTTPS it is 443..
Thanks miny. Nice information
safwan
safwan · Mar 5, 2009
Rank B2 - LEADER
thanks miniy good information.😎
Sachin Jain
Sachin Jain · Oct 22, 2010
Rank C2 - EXPERT
@miny
Very nice info but m having some doubt..please clarify it
How does the receiver know which of the two (SSL or TLS) encyrption is used ?
Munguti
Munguti · Oct 22, 2010
Rank C3 - EXPERT
@bluderboy, the unique ports used will tell the reciever or server whether its HTTP-port 80 or HTTPS-port 443. This ports are unique and consistent. The also separate services such as mail, DNS and other applications and are used for managing sessions. You should read more on ports
lovejeet
lovejeet · Oct 24, 2010
Rank C1 - EXPERT
and please wat difference both makes if we use them.........................
lovejeet
lovejeet · Oct 25, 2010
Rank C1 - EXPERT
ya, that i got...............so why isn't it dat https should b mostly used??? plz enumerate all the differences on d basis of use n limitations n all............
Ankita Katdare
Ankita Katdare · Feb 4, 2016
Rank A1 - PRO
lovejeet
ya, that i got...............so why isn't it dat https should b mostly used??? plz enumerate all the differences on d basis of use n limitations n all............
Since it is one of the most important questions that has been left unanswered, I thought I should list down my answer here.

If you want the short point-by-point answer, here we go -

HTTP (or Hyper Text Transfer Protocol)
  1. It is an unsecured connection.
  2. There is no encryption.
  3. No certificates are required.
  4. The website URL begins with https://
  5. It uses port 80 for communication.
  6. Operates at Application Layer of the OSI network model.
HTTPS (or Hyper Text Transfer Protocol Secure)
  1. It is an secured connection.
  2. It is an encrypted connection.
  3. No certificates are required.
  4. URL begins with “https://”
  5. It uses port 443 for communication
  6. Operates at Transport Layer of the OSI network model.
If you want the long answer, read on -

HTTP is the name of the protocol used to send & receive information over the internet. It turns out that when thousands of websites were getting built on the internet, many website owners wanted to exchange confidential information across different websites through a server. With HTTP protocol information would be accessed without secure authorisation. Therefore, Netscape corporation decided to create HTTPS, the secure version of HTTP to allow authorisation and secured transactions.

HTTPS is a lot similar to HTTP as it follows the same basic protocols. They operate by a website URL sending information request to server which then responds with the status and a message. The status could be positive or negative depending upon the request.

Since HTTP or HTTPS is a part of the URL, the form of request changes. If HTTPS is used instead of HTTP in a URL, the server knows that an 'encrypted' connection is being requested.

HTTPS connection is typically desired in following scenarios:
1. Log-in pages of websites
2. Secure banking related transacations
3. Corporate log-ins
4. Websites where confidential information is exchanged between users and admin etc.
TurtleDove
TurtleDove · Mar 22, 2016
Rank E2 - BEGINNER
Http and Https both are the part of Url, and its uses the same protocol. The only difference between them is https is secured as the data requested or sent is in "ENCRYPTED".
Stephen B Johnson
Stephen B Johnson · Aug 5, 2016
Rank D2 - MASTER
Start wireshark, tcpdump, or whatever packet capture tool you have access to and capture some packet transfers for https://somedomain (which will use port 80) and https://somedomain (which will use port 443).

You will see the content using https:// (port 443) is all encrypted.
Ken Peterson
Ken Peterson · Mar 31, 2017
Rank E2 - BEGINNER
HTTP stands for Hypertext Transfer Protocol. This protocol allows communication between different systems. When you type any web address, your browser acts as a client and the computer act as a server. HTTP uses TCP (Transmission Control Protocol), generally over port 80, to send and receive data packets over the web.
How it functions?
The client sends a request message to a HTTP server which hosts a website, the server then replies with the response message that contains completion status information, such as “HTTP/1.1 200 OK”.

HTTPS stands for Hypertext Transfer Protocol Secure. This protocol allows a secure communication between different systems. It encrypts all data during the communication. HTTPS also uses TCP (Transmission Control Protocol) to send and receive data packets, but it does so over port 443, within a connection encrypted by Transport Layer Security (TLS).
yogevo
yogevo · Jun 10, 2017
Rank E2 - BEGINNER
This is the awesome website for students like me.
rajmanisha
rajmanisha · Jul 6, 2017
Rank E1 - BEGINNER
http is a unsecured connection while https is an encrypted secured connection.
Rahul Jamgade
Rahul Jamgade · Aug 21, 2017
Rank D1 - MASTER
Ankita Katdare
Since it is one of the most important questions that has been left unanswered, I thought I should list down my answer here.

If you want the short point-by-point answer, here we go -

HTTP (or Hyper Text Transfer Protocol)
  1. It is an unsecured connection.
  2. There is no encryption.
  3. No certificates are required.
  4. The website URL begins with https://
  5. It uses port 80 for communication.
  6. Operates at Application Layer of the OSI network model.
HTTPS (or Hyper Text Transfer Protocol Secure)
  1. It is an secured connection.
  2. It is an encrypted connection.
  3. No certificates are required.
  4. URL begins with “https://”
  5. It uses port 443 for communication
  6. Operates at Transport Layer of the OSI network model.
If you want the long answer, read on -

HTTP is the name of the protocol used to send & receive information over the internet. It turns out that when thousands of websites were getting built on the internet, many website owners wanted to exchange confidential information across different websites through a server. With HTTP protocol information would be accessed without secure authorisation. Therefore, Netscape corporation decided to create HTTPS, the secure version of HTTP to allow authorisation and secured transactions.

HTTPS is a lot similar to HTTP as it follows the same basic protocols. They operate by a website URL sending information request to server which then responds with the status and a message. The status could be positive or negative depending upon the request.

Since HTTP or HTTPS is a part of the URL, the form of request changes. If HTTPS is used instead of HTTP in a URL, the server knows that an 'encrypted' connection is being requested.

HTTPS connection is typically desired in following scenarios:
1. Log-in pages of websites
2. Secure banking related transacations
3. Corporate log-ins
4. Websites where confidential information is exchanged between users and admin etc.

Minor Correction and adding few additional points:
1. https require certificate . It could be issued by CA (Certificate Authority) or Self Signed.
2.TLS works above the transport layer in the OSI model
3. port 80 and port 443 are default ports for http and https. However you can change the ports at your will (by admin of the website), provided the ports are free.
4. Though https is used for secure communication and was believed to be unbreakable, however there are ways by which the data can be read.In this case the user or victim can be tricked easily so that data can be sniffed.
5. SSLv2 and SSLv3 are broken , so should not be used.
Radhika Deshpande
Radhika Deshpande · Oct 4, 2018
Rank B2 - LEADER

Can we set http and https on same port?

Kaustubh Katdare
Kaustubh Katdare · Oct 4, 2018
Rank A1 - PRO

Interesting question, @Radhika . To the best of my knowledge, running http and https on the same port is *not* possible with Apache. I think that's because there's some port-blocking.

However, with NGINX, it's possible to run both http and https on the same port. It is likely to require patching; which I'd not recommend as it creates issues at the time of upgrading the web server.

Here's a solution that I found on the server that seems to work with NGINX:

Add ssl on; and error_page 497 $request_uri; to your server definition.

Give it a try; but don't on a live or production server. You're likely to mess things up. Try this on a local installation and let me know what you observe. It'd be something very interesting. 

Kavya Burramolla
Kavya Burramolla · Jan 24, 2020
Rank C1 - EXPERT

Both HTTP(Hyper Text Transfer Protocol) and HTTPS (Hyper Text Transfer Protocol Secure) are used for transmission and retrieval of information over internet with port numbers 80 and 443 respectively. HTTP is a unencrypted protocol whereas HTTPS is a encrypted protocol mean the data transmission through HTTP and HTTPS is through unencrypted and encrypted medium respectively. 

Since large amount of data transmission takes place over internet it has become an open house for multiple data transmissions and transactions which resulted in insecurity. With HTTP any user can fetch or send the data over internet resulting in the data transmitted which is insecured. There comes the encrypted and secure protocol HTTPS for transmission of data. All the Sign In portals make use of HTTPS for the security purpose. 

Noothan Kumar
Noothan Kumar · Jan 24, 2020
Rank D1 - MASTER

HTTP is Hyper Text Transfer Protocol and HTTPS is Hyper Text Transfer Protocol Secure... is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 's' at the end of HTTPS stands for 'secure'. It means all communications between your browser and the website are encrypted.

You must log-in or sign-up to reply to this post.

Click to Log-In or Sign-Up