HTTP compared with HTTPS

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which protocol sends data as readable plain text?

A HTTPS

B HTTP

2. What does HTTPS add to HTTP?

A A faster internet connection

B SSL/TLS encryption

3. A hacker intercepts data sent over HTTPS. What do they see?

A Scrambled data they cannot read

B The password in plain text

4. Which page should definitely use HTTPS?

A A payment page that takes card details

B A page of public opening times

5. What does a digital certificate show about a website?

A The website is genuine

B The website has no adverts

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1http://school-shop.com/login		AData is encrypted using SSL/TLS, so intercepted data cannot be read
2https://school-shop.com/login		BData is sent as plain readable text, so anyone who intercepts it can read it
3A login or payment page should use the secure protocol so passwords and card numbers are protected		CHTTP does not encrypt data. It sends plain text that can be intercepted. A payment page needs HTTPS.
4The security layer that HTTPS adds to HTTP to encrypt the data		DSSL/TLS
5Enter card details on http://shop.com/pay because HTTP encrypts the data		Ehttps://bank.com/payment
6HTTPS is secure because it sends data as plain text		FHTTPS does not send plain text. It encrypts data with SSL/TLS so intercepted data cannot be read.

Definitions

HTTPS

Fill in the Blanks

Complete each line of code by filling in the missing parts.

_____://www.mybank.com/login.html

HTTPS = HTTP + _______

IF page = "payment" THEN use _____

HTTPS site shows a digital ___________

http data is sent as _____ text

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A url ← "https://shop.com/pay"

B IF url STARTS "https" THEN

C send data as plain text

D ENDIF

Question 2

A url ← "http://bank.com/pay"

B IF url STARTS "https" THEN

C OUTPUT "Padlock shown"

D ENDIF

Question 3

A IF page = "payment" THEN

B protocol ← "HTTP"

C ENDIF

Question 4

A browser requests the page

B server sends its cookie

C IF certificate valid THEN

D OUTPUT "Site is genuine"

Question 5

A hacker INTERCEPTS data

B IF protocol = "HTTPS" THEN

C data is scrambled

D hacker can read it easily

E ENDIF

Answer Key

HTTP compared with HTTPS

Section A: Quick Questions

B — HTTP

B — SSL/TLS encryption

A — Scrambled data they cannot read

A — A payment page that takes card details

A — The website is genuine

Section B: Match the Pairs

http://school-shop.com/login → Data is sent as plain readable text, so anyone who intercepts it can read it

https://school-shop.com/login → Data is encrypted using SSL/TLS, so intercepted data cannot be read

A login or payment page should use the secure protocol so passwords and card numbers are protected → https://bank.com/payment

The security layer that HTTPS adds to HTTP to encrypt the data → SSL/TLS

Enter card details on http://shop.com/pay because HTTP encrypts the data → HTTP does not encrypt data. It sends plain text that can be intercepted. A payment page needs HTTPS.

HTTPS is secure because it sends data as plain text → HTTPS does not send plain text. It encrypts data with SSL/TLS so intercepted data cannot be read.

Section C: Definitions

HTTPS — HTTP plus SSL/TLS encryption. Plain HTTP sends readable text that can be intercepted; HTTPS scrambles data so intercepted data can't be read, and a certificate shows the site is genuine.

Section D: Fill in the Blanks

https://www.mybank.com/login.html

HTTPS = HTTP + SSL/TLS

IF page = "payment" THEN use HTTPS

HTTPS site shows a digital certificate

http data is sent as plain text

Section E: Spot the Error

C — An HTTPS address means SSL/TLS is used, so the data is encrypted. Line 3 should be 'encrypt data with SSL/TLS', not send it as plain text.

A — A payment page must use HTTPS so the card details are encrypted and the padlock shows. The URL should start with https://, not http://.

B — Payment and login pages need HTTPS so that the data is encrypted. The protocol should be "HTTPS", because plain HTTP is not secure.

B — The server proves it is genuine by sending its digital certificate. A cookie does not prove the site is genuine, so line 2 should say 'certificate'.

D — With HTTPS the data is encrypted, so an intercepted copy is scrambled and cannot be read. Line 4 should say the hacker cannot read it.