HTTPS
A secure transport protocol for HTTP based on TLS/SSL that relies on the PKI certificate system to establish trust.
Timeline (last 90 days)
Lunduke believes that the CA system on which HTTPS depends is essentially 'trust-based security' rather than 'math-based security.'
The 'lock' in the browser address bar only means that the connection was signed by some CA, and does not mean that the other party's identity is absolutely trustworthy.
The centralized trust model is fragile: the operational security of a handful of CAs directly determines the reliability of HTTPS worldwide.
Because the robot usually communicates with the cloud over HTTPS, developers often need to bypass or replace certificate verification to fully reproduce the handshake locally.
Relying solely on HTTPS only guarantees the security of the transmission channel; it cannot answer the question of whether a reply is legitimate; the reply side must explicitly satisfy authenticity, integrity, and traceability.
Decrypting HTTPS traffic in Fiddler requires installing its root certificate on the device; the underlying principle is replacing the server certificate with a self-signed certificate to complete a decrypt-inspect-re-encrypt workflow.
When HTTPS packet capture fails, certificate trust issues should be investigated first.
One-click exposure of a model from a Notebook as a public HTTPS endpoint requires handling security issues such as authentication, rate limiting, and data privacy.
Modern browsers display a 'Not Secure' warning for HTTP websites, and certain features such as accessing geolocation and camera permissions are only available to HTTPS websites.
Custom Connectors only support REST APIs exposed via HTTPS.
6 more timeline events
All Facts (18)
全球HTTPS普及率从不足40%跃升至如今的90%以上
75%UnverifiedSSL certificates are the core credentials that secure HTTPS encrypted communication for websites; once revoked, browsers will display security warnings or even block access.
60%Unverified即便站点使用了HTTPS，也只能保证用户到代理服务器之间的传输安全，代理服务器本身仍可完整读取用户的所有内容
60%UnverifiedThe 'lock' in the browser address bar only means that the connection was signed by some CA, and does not mean that the other party's identity is absolutely trustworthy.
50%UnverifiedLunduke believes that the CA system on which HTTPS depends is essentially 'trust-based security' rather than 'math-based security.'
50%UnverifiedThe centralized trust model is fragile: the operational security of a handful of CAs directly determines the reliability of HTTPS worldwide.
50%UnverifiedBecause the robot usually communicates with the cloud over HTTPS, developers often need to bypass or replace certificate verification to fully reproduce the handshake locally.
50%UnverifiedRelying solely on HTTPS only guarantees the security of the transmission channel; it cannot answer the question of whether a reply is legitimate; the reply side must explicitly satisfy authenticity, integrity, and traceability.
50%UnverifiedDecrypting HTTPS traffic in Fiddler requires installing its root certificate on the device; the underlying principle is replacing the server certificate with a self-signed certificate to complete a decrypt-inspect-re-encrypt workflow.
50%UnverifiedWhen HTTPS packet capture fails, certificate trust issues should be investigated first.
50%UnverifiedOne-click exposure of a model from a Notebook as a public HTTPS endpoint requires handling security issues such as authentication, rate limiting, and data privacy.
50%UnverifiedModern browsers display a 'Not Secure' warning for HTTP websites, and certain features such as accessing geolocation and camera permissions are only available to HTTPS websites.
50%UnverifiedCustom Connectors only support REST APIs exposed via HTTPS.
50%UnverifiedManually installing root certificates itself introduces new security risks, undermining the trust guarantees promised by HTTPS.
50%UnverifiedFor large model API calls that go over HTTPS, network-layer observation can see the connection being established but the content is encrypted, requiring other means to reconstruct the call details.
50%UnverifiedHTTPS traffic flowing through Cloudflare is decrypted and re-encrypted at its edge nodes, giving the service provider the technical capability to observe plaintext traffic.
50%UnverifiedMany Web APIs in modern browsers (such as Geolocation, getUserMedia, Service Worker, Clipboard API, and Web Bluetooth) can only be used in an HTTPS environment or under localhost.
50%UnverifiedMany powerful Web APIs (such as Geolocation, getUserMedia, Service Worker, Clipboard API, and Web Bluetooth) can only be used in an HTTPS environment or under localhost.
50%