How does HTTPS (TLS) protect a web connection step by step?

Your browser verifies the site's certificate (PKI), performs a key exchange (Diffie-Hellman or RSA), establishes a shared AES session key, then encrypts all communication — the padlock icon confirms this succeeded HTTPS means the website owner has paid for a security certificate — no cryptography is involved Your browser downloads the encryption key directly from the website and uses it to scramble data HTTPS uses a government-controlled encryption key that only authorized websites can use

How does end-to-end encryption in messaging apps (Signal, WhatsApp) work?

Each device holds a private key; messages are encrypted with the recipient's public key on the sender's device — the server transmits the ciphertext but can never decrypt it Messages are encrypted by the app company's servers and decrypted when delivered Both users share a secret password that they use to encrypt and decrypt messages The app scrambles messages using a unique pattern that only it knows how to reverse

How does 'full disk encryption' (like FileVault on Mac or BitLocker on Windows) protect a laptop?

The entire disk is encrypted with AES using a key derived from your password — if the laptop is stolen, the data is unreadable without your password even by connecting the drive to another computer The disk is physically locked so it can't be removed from the laptop without a special tool Individual files are encrypted; the disk structure itself remains unencrypted Disk encryption prevents the computer from being turned on without the correct fingerprint

How does cryptocurrency use cryptography to prevent double-spending?

Digital signatures (private key signs transactions) prove ownership; blockchain (hash-linked distributed ledger) makes transaction history immutable — spending the same coin twice would require rewriting the blockchain, which requires more computing power than all honest miners combined Cryptocurrency companies maintain a central database of all transactions and check for duplicates Each coin has a unique serial number that is checked before any transaction Encryption prevents copying — you can't copy a cryptocurrency because it's encrypted

How does 'code signing' protect software from tampering?

Developers sign software with their private key — your computer verifies the signature against the developer's public certificate before installing, ensuring the software wasn't modified after signing Software companies register their code with a government database that verifies authenticity Code signing means the code has been reviewed and approved by security experts An automatic process where software signs itself to prevent piracy

What is a 'security token' or hardware key (like a YubiKey)?

A physical device storing cryptographic keys — it generates OTPs or performs cryptographic operations without exposing the private key, making phishing nearly impossible as the token physically must be present A reusable access card that stores your username and password on a chip A device that generates random numbers for creating strong passwords A physical backup of your encryption keys stored in a secure USB drive

What are 'secure enclaves' (like Apple's Secure Enclave, Intel SGX)?

Hardware-isolated processing environments within a chip that protect sensitive operations (like biometric data comparison or private key usage) even from the main operating system Software vaults for securely storing passwords in encrypted databases Physical vaults where tech companies store their master encryption keys A secure mode that activates when a device detects suspicious activity

What is 'certificate pinning' and why do some apps use it?

Hard-coding a specific certificate or public key in an app — the app only trusts connections to that exact certificate, preventing MITM attacks even with a rogue CA-signed certificate Physically pinning (securing) certificates to hardware to prevent them from being stolen A process of permanently attaching a certificate to a domain name Requiring users to enter a PIN number before any certificate is used for authentication

What is 'secure deletion' and why is simply deleting a file insufficient?

Overwriting data with random patterns before deletion — normal deletion only removes the file's directory entry; the data itself remains on disk and can be recovered until overwritten Using the Recycle Bin or Trash to delete files — this makes them unrecoverable Deleting files with encryption turned on — this automatically makes them unrecoverable A type of deletion that only secure (admin) users can perform on classified documents

Why should you always check the URL and certificate before entering sensitive information on a website?

Phishing sites can look identical to real sites but have different domains and forged or invalid certificates — the URL and padlock are the only reliable indicators of the real site's identity The padlock means the site has been verified as legitimate by the government Only check the URL — the certificate doesn't contain useful information for regular users Only banking sites need URL verification — other sites are automatically safe