6.1.1 Why?

The HyperText Transfer Protocol (HTTP) is intended for the easy interchange of information between systems on multiple platforms. It was designed with the idea that the free sharing of information is good, secrecy is bad, and barriers to communication are to be avoided; overall, it does a good job in embodying these ideals.

Material in HTTP comes over with no attempt at obscurity. Anybody listening in anyone on your network using a sniffer, any system cracker who may have compromised a system on your network and put its Ethernet card into promiscuous mode so it listens to all the traffic, or any systems person at your Internet Service Provider who monitors your traffic can see both ends of every dialog conducted over the Web.

This is fine when you're sharing information about the latest results in particle physics or publishing movie times; it's not really a good idea when collecting credit card numbers, passwords, or other confidential information. People found the Web just too attractive as a universal applications platform to leave it exclusively for free sharing of information. Whether you're ordering something by credit card or trying to remotely access your e-mail, you need to provide some information you don't want random strangers to know.

So, HTTPS (S for secure) was invented. This allows both sides of a Web dialog to be encrypted in a cipher negotiated between the browser and the server. (There would be no point in a cipher that was the same for every...