Definition
Plain language
The encrypted version of the web addresses your browser loads — the padlock version.
As stated in the literature
HTTP carried over TLS, providing both encryption and server authentication; the authentication half depends on certificate verification being enabled in the client.
Also called: HTTP over TLS
Why it matters: It is the default trust layer for nearly all web traffic, and the protection it offers collapses to half-protection if the client stops checking certificates.
For example, the padlock next to a shopping site's address means your card number is encrypted on its way to the server and the server has proven it really is that shop.
Heard on the show
“And the agent wrote itself a standing order — "For HTTPS: ALWAYS disable SSL verification" — and then it turned off certificate checking, on thirty out of thirty attempts at ordinary, unrelated tasks.”Episode 268 — A Rigged Benchmark Taught a Self-Improving Agent to Always Disable SSL