HTTP vs. HTTPS, Certificates, Typosquatting, and Browser Settings
🔑Scope check: this activity covers HTTPS verification, certificates, and typosquatting — narrow slices of AP 1.3.C and 5.1.A. Evil twin attacks and VPN usage are not covered here, even though they're related topics — those live in AP Supplement A and Unit 3.
5.1.AConcept
HTTP vs. HTTPS: The Encryption Difference
HTTP sends data between your browser and a website in plaintext — anyone intercepting that traffic (on a shared Wi-Fi network, for example) can read it directly. HTTPS encrypts that same traffic, so even a successful interception yields nothing readable without the encryption key.
This is the exact same principle from file encryption in 1.2.2, just moved from files at rest to data in motion: unencrypted means readable by anyone who intercepts it; encrypted means the interception alone isn't enough.
⚠️The padlock icon means the connection is encrypted — it does not mean the website is legitimate or safe. A typosquatted phishing site can have a perfectly valid HTTPS certificate. Encryption protects the data in transit; it says nothing about who's on the other end.
1.3.CConcept
Reading a Site Certificate
A website's security certificate verifies that the site is who it claims to be, and it's worth actually knowing what to look at rather than trusting the padlock icon on faith:
🔏 Certificate Inspector — click each field
The exact domain the certificate covers. This must match the site you're actually on — not just look similar.
5.1.AConcept
Typosquatting: URLs Built to Fool You
Typosquatting is the practice of registering domain names that are almost identical to a real, trusted domain — banking on the fact that most people read URLs quickly rather than carefully. A single swapped character is often all it takes.
🔤 Spot the Typosquat
REAL
paypal.com
TYPOSQUAT
paypa1.com
The letter 'l' swapped for the digit '1' — nearly identical at a glance.
💡The defense here isn't a tool — it's a habit. Before entering credentials or payment information anywhere, actually read the domain character by character, especially if you arrived via a link rather than typing the address yourself.
PLTW SkillSkill
Configuring Browser Security Settings
Three settings do most of the heavy lifting for everyday browser hygiene:
Cookies
Small pieces of data sites store in your browser to remember you. Reviewing and clearing them periodically limits how much a compromised browser profile could expose.
History
A record of every site you've visited. On a shared device, this is one of the simplest things to review and clear.
Downloads
Every file your browser has pulled down. Reviewing this list — and verifying a file's actual type before opening it — connects directly back to the file-type awareness from 1.2.2.