To take action : 10–20 min to review settings · Depending on your devices and accounts
What the little padlock means
Distinguish encrypted connections, private messages and disk protection.
PatchYourself · Last editorial revision : · Sources
Fictional example: an everyday situation
A suspicious delivery website shows HTTPS. Lea understands the connection is encrypted but the site still receives anything she types. She closes it and opens the official app.
The problem
Encryption protects data using keys. To understand its protection, ask where it begins and ends, and who holds the keys.
Three different protections
The connection: HTTPS
HTTPS uses TLS to protect the path between browser and website. The icon varies by browser; check connection information and warnings rather than relying on one particular padlock.
A fraudulent website can use HTTPS. It receives the information you submit. Encrypting the path therefore does not prove the destination is honest.
Messages: end-to-end encryption
With end-to-end encryption, participants’ devices hold the keys needed to read the contents. The provider normally cannot read those contents in transit. Recipients can still copy or share them, and a compromised device can expose them.
Check conversation type, backups and linked devices. An app may offer different modes. Ordinary email can be encrypted in transit without being end-to-end encrypted: mail servers can generally access its contents.
Storage: disk encryption
This protects stored data when the attacker cannot access the keys. It does not turn a stolen computer into unusable hardware and does not necessarily protect an already open session.
What to do now
Step 1: Respect connection warnings
Do not enter sensitive information on a page marked insecure. Do not ignore certificate warnings, and check the expected domain.
Step 2: Check your messaging
For sensitive conversations, choose a suitable end-to-end encrypted mode, such as a Signal conversation. Review linked devices and backup protections. An app’s name alone does not tell you how a particular message is protected.
Step 3: Prepare recovery keys
Before enabling or changing FileVault, BitLocker or an encrypted backup, store its recovery method separately from the device. Check the options for your version and maintain a strong device lock.
Go further
Public keys
Public-key mechanisms can authenticate a party or establish a shared secret. Data encryption then uses mechanisms suitable for larger volumes. Details depend on the protocol.
How long protection lasts
Security depends on algorithms, implementation, keys and devices. Cryptographic developments do not justify promises of invulnerability. For everyday use, keep software updated and protect recovery methods.
Sources and verification
References used for this revision. Menus and offers can change; consult the provider’s help for your version.