What the padlock means.
WHAT ENCRYPTION IN TRANSIT DOES
Prevents traffic being read between you and the service.
WHAT IT DOES NOT DO
Prove the site is legitimate Protect the data once it arrives Protect you from a compromised device
THE LEGITIMACY POINT
A fraudulent site can have a valid certificate.
The padlock means the connection is encrypted, not that the site is honest.
WHAT TO CHECK
The address itself, carefully.
Attackers use addresses that look almost right.
WHAT TO NEVER DO
Dismiss a certificate warning to reach a site Enter credentials on a page reached from a message
WHAT ELSE USES ENCRYPTION
Email between servers, sometimes File transfer, where configured Remote access
WHAT TO ENSURE
That every service you use is configured to use encryption.
For file transfer particularly, plain protocols send passwords readable.
WHAT TO CHECK ON YOUR OWN SITE
That it loads securely throughout.
