Session 6: Encryption & Web Security

Encryption converts data into a form that is unreadable without a key, and it applies in two distinct places. In transit means while data travels — between your browser and a website, your phone and a server. At rest means while data sits — on your laptop's disk, your phone's storage, a backup drive in a drawer. Both matter, and people usually think about only the first.

At rest is the one most people neglect, and it is what makes device theft survivable. An unencrypted laptop that is stolen hands over every file on it immediately. An encrypted one hands over a brick, because the data is unreadable without the key. Both Windows (BitLocker) and macOS (FileVault) provide this, and Android and iOS encrypt by default when a passcode is set — so for most phones the action is simply to have a real passcode rather than none.

In transit is what HTTPS provides, and it is now the default on almost the entire web. The important idea is that encryption protects the content of the connection from anyone watching the network, which on public Wi-Fi or any network you do not control is the difference between your banking details being readable and being noise.

Enable encryption on every machine you or a client uses. On Windows, check whether BitLocker or device encryption is available and enabled; on macOS, confirm FileVault is on. On phones, a passcode or biometric lock is what activates the built-in encryption, so a phone with no lock is an unencrypted phone.

The critical and routinely skipped step is the recovery key. Full-disk encryption means that if something goes wrong — a hardware change, a failed update, a forgotten PIN — the data is genuinely inaccessible without the recovery key. That is the entire point of encryption, and it applies equally to you. Save the key somewhere that is not the device: printed and kept safely, or stored in a password manager or a Microsoft or Apple account.

Losing the recovery key is unrecoverable by design, and it is a real outcome: people enable encryption, something breaks a year later, and years of files are gone. So the honest guidance is that enabling encryption is essential and saving the recovery key is part of enabling it, not an optional extra. Write it into any procedure you give a client.

HTTPS encrypts the connection between your browser and the website, and it does three useful things. It protects the content from anyone watching the network. It proves the site's identity through a certificate issued to that domain, so you are talking to the real bank rather than an impostor on the network. And it protects integrity, so nobody in between can alter what is sent or received.

Now the three things it does not do, which matter more. It does not make a site trustworthy — criminals obtain valid certificates routinely, and a padlock on a fraudulent site is entirely normal. It does not protect against phishing, because a proxied fake site can present a valid certificate for its own domain while you believe you are on the real one. And it does not protect the site's own security — an HTTPS site can still be breached, and your data stored there can still be stolen afterwards.

The practical conclusion: HTTPS is necessary and it is table stakes, but it is not a trust signal. The trust question is answered by the domain name, which is why checking the URL remains the single most important habit in web safety. A padlock tells you the connection is encrypted; only the address tells you who you are talking to.

A certificate warning means the browser could not verify the site's identity, and it should be treated as a hard stop rather than a nuisance to click through. The common causes: an expired certificate, which is sloppy but not necessarily malicious; a name mismatch, where the certificate belongs to a different domain, which is a serious signal; and an untrusted issuer, which can indicate someone intercepting your connection.

The discipline is simple: on a site where you enter credentials or make a payment, a certificate warning means stop. Close the tab and type the address yourself. On a site where you are reading an article and entering nothing, the risk is lower but still worth noting. Never click through a warning to reach a banking or email page, because that is precisely the situation an interception attack creates.

One legitimate exception is worth knowing: a warning on a site you are reaching through a captive portal — the login page on hotel or airport Wi-Fi — is normal, because the network is intercepting to present its login. That is expected. What is not expected is a warning on your bank, and distinguishing the two is a matter of noticing where you are rather than any technical test.

Safe online payment is mostly about the site, not the padlock. Check the domain carefully — a fraudulent store will use a name close to a real one. Prefer established payment methods that offer protection, and be sceptical of a seller who insists on a direct bank transfer for goods from an unknown source, because that route has no recourse. For Nigerian online shopping, recognised marketplaces and payment processors exist precisely because direct transfers to strangers are how most e-commerce fraud works.

End-to-end encryption is a distinct and stronger idea: the message is encrypted so that only the sender and recipient can read it, and nobody in between — not even the service provider — can. WhatsApp messages use it, which is why the content is protected in transit. But understand the limits: end-to-end encryption protects the content, not the metadata (who you contacted, when, how often), and it does nothing at all about what happens at either end — a compromised phone reads everything, and a screenshot defeats any encryption.

So the honest summary is that encryption is genuinely powerful and genuinely limited. It makes stolen devices useless and network eavesdropping useless, and it does nothing about phishing, weak passwords, malware on your own machine, or a person you trusted. Knowing both halves is what lets you advise a client correctly rather than either overselling encryption or dismissing it.