Skip to contentExploitQuest
Join free
← Writing

The Padlock Is Not a Trust Badge

HTTPS makes one specific promise and people hear three others. Phishing sites have padlocks too — here is what the icon actually guarantees, and the thirty seconds of address-bar reading that does the job people think it is doing.

There is a padlock, so the site is secure. It is the most widely held security belief there is, and it is close enough to true to be dangerous. The padlock means one specific, valuable thing. People hear three other things it never said, and one of those misreadings is how phishing works.

The one real promise

The padlock means HTTPSTLSThe encryption behind the padlock — it scrambles the contents of a page between your device and the site so nobody in between can read it. is in use: the connection between your browser and *that server* is encrypted, and nobody on the path — your ISPISPYour internet service provider — the company whose wire or signal you use to reach the internet, and which can see every site you connect to., the café Wi-Fi, someone sitting between — can read or alter what passes. That is genuine, it matters, and it is the entire promise.

The padlock guarantees:
  1. The traffic to this server is encrypted (private in transit)
  2. It reached the server the certificate is for (not silently redirected)

The padlock does NOT guarantee:
  3. The site is honest, safe, or not a scam
  4. The company behind it is who the name suggests
  5. What the site does with your data once it has it
  1. Line 2Real and worth having. On hostile Wi-Fi this is exactly what stops somebody reading your traffic.
  2. Line 7A phishing page can hold a perfectly valid certificate for its own lookalike domain. The padlock is green; the site is a trap.

Why this changed, and nobody was told

A decade ago certificates cost money and involved paperwork, so a padlock was weak evidence that somebody had at least filled in a form. Then certificates became free and automatic, which was an enormous win for the web — nearly everything is encrypted now, by default, including this page.

The side effect is that the padlock stopped carrying even that weak signal. Scammers automate certificates like everyone else. The icon did not change, the advice people repeat did not change, and the meaning underneath it did.

You land on paypa1-secure.example — note the digit "1" — and it shows a padlock. Is your money safe?

The thing that does carry the signal

The address bar. Not the padlock, not the page design, not the logo — the domain name, read carefully, right to left. The real site name is the label just before the final suffix, and everything to the left of it can be anything the attacker likes.

Where the real site name lives in a URL
# the important part is the label just before the final dot-suffix
https://accounts.google.com/signin        -> google.com   (real)
https://google.com.account-verify.example -> account-verify.example  (not)
https://xn--80ak6aa92e.example            -> punycode; look twice, letters can lie

That second line is the whole trick. google.com appears in it, in full, spelled correctly — and it is a subdomain of somebody else's site. Reading left to right, you find the brand and relax. Reading right to left, you find account-verify.example and stop.

Trusting the padlock

- "It has a padlock, so I will log in"
- Skimming the domain, seeing the brand word somewhere in it
- Following a link from an email straight into typing a password

Reading the address

- Read the domain right to left, and find the real name before the suffix
- Reach important sites by a saved bookmark, never a link you were sent
- Treat "urgent, verify now" as the tell it almost always is

The padlock secures the road. Reading the domain tells you whose building you arrived at. You need both, and only one of them is automatic.

So what should you do with it?

Keep one hard rule and one habit. The rule: no padlock on a page asking for a password is a full stop — close the tab. The habit: a padlock being present is the beginning of your checking, not the end of it.

And spend the attention you were giving the icon on the address bar instead. It is the part no certificate can vouch for, which makes it the only part worth reading closely.

This is one lesson from the free Anonymity & OpSec course, which covers the rest of what a browser gives away — cookies, fingerprintingBrowser fingerprintA near-unique profile of your device built from the small ways your browser differs from everyone else's — no cookies required., and what private browsing genuinely does.