Task 7.12: Using HTTPS to Encrypt Web Traffic

The Web can be a dangerous place. Fake URLs, malicious links, and spyware are just a few of the problems Internet users have to worry about. Another big concern is the protection of Internet traffic. Anyone using an open wireless connection at a coffee shop or wired in at a hotel could be vulnerable to sniffing attacks. One way to deter such activity is through the use of encryption mechanisms such as HTTPS.

Scenario

Your organization is concerned about its road warriors and mobile employees who use the Internet at public locations for work-related activities. You have been asked to develop a low-cost security solution.

Scope of Task

Duration

This task should take about 10 minutes.

Setup

For this task, you’ll need a Windows computer, access to the Administrator account, and an Internet connection.

Caveat

While HTTPS encryption provides an additional layer of protection, it cannot protect against attacks such as key loggers.

Procedure

In this task, you will learn how to use the HTTPS Anywhere application.

Equipment Used

For this task, you must have:

• A Windows XP, Windows Vista, or Windows 7 computer
• Access to the Administrator account
• An Internet connection
• The Firefox web browser

Details

This task will show you how to install HTTPS Anywhere.

Using Hashing Algorithms

1. Download HTTPS Anywhere from www.eff.org/deeplinks/2010/06/encrypt-web-https-everywhere-firefox-extension. It is a browser add-on that can be installed into Firefox.

HTTPS is a combination of the Transport Layer Security (TLS)/Secure Sockets Layer (SSL) protocol and the Hypertext Transfer Protocol (HTTP). Its purpose is to provide encrypted communication and the secure identification of a network web server.

2. After clicking the Install Now button, you will be prompted to install HTTPS Anywhere.

3. Once installation is complete, you will be prompted to restart Firefox and then to identify the well-known services you would like to secure via HTTPS.

4. Redirect your browser to www.google.com and then to www.facebook.com. Notice the extension for both sites now that you have installed HTTPS Anywhere.

While most websites offer encryption for authentication, many still allow subsequent browsing of their site via HTTP. HTTPS adds an additional layer of protection for those sites. This additional layer of protection is useful for anyone using a public Internet connection.

Criteria for Completion

You have completed this task when you have installed and configured HTTPS Anywhere.