Browser behavior using HTTPS protocol for a login form

Question

It is known that:

In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or, formerly, Secure Sockets Layer (SSL)

(Source)

My question is: having a simple HTML login form hosted on an HTTPS enabled server, when the user enters the address starting https:// does the browser automatically encrypt the login data (login and password) thus allowing for secure communication (i.e., the browser sees the HTTPS protocol and understands that the data to send has to be encrypted)?

Answer 1

The communication process is a bit complicated so critical encryption keys are never exposed, but the data is sent after the point of a shared secret key. It is still best practice to not assume a login attempt will never be attempted on the un-encrypted port of 80. But this lack of the assumption the data is encrypted is a backup precaution to insure security for the client.

It should be noted that it is possible for a browser to negotiate a no-encryption standard to the server. SSL.com strongly recommends you not do this but it is a possibility. Banks would of course not support a no-encryption protocol on their servers.

At the early stage ...

• The client browser and the web server exchange "hello" messages. Note port 443 is an SSL port so this hello is nothing more than a connection.

• Both parties communicate their encryption standards with each other.

• The server shares its certificate with the browser.

• The client verifies the certificate's validity.

So the initial communications from the browser to the https port is a request for the public certificate. Not user data. A shared secret key is computed from the public keys using the private keys, which is understood and agreed by both, and user data is then sent encrypted by this shared secret key, which is only known by these two computers and used for the session.

The more detailed communications are ... And, note there are two servers involved your site and the certificate authority.

The only potential non-encrypted information (beyond IP numbers) is the DNS request for the site name, but the client, (browser), can use an encrypted DNS service which encrypts that information as well.