A Padlock Does Not Mean a Site Is Honest

A padlock for everyone

Yesterday Let's Encrypt, the free certificate authority, began issuing wildcard certificates: a single certificate that covers every subdomain of a domain.

It is good news for anybody running many subdomains. It also completes a change that has been under way for a couple of years: the padlock is now free, automatic and available to anyone who controls a domain name.

That includes the people who build fake sign-in pages and fake shops.

For years, staff and customers were told to look for the padlock before typing a password or a card number. That advice is now out of date.

What the padlock proves

The padlock means the connection between the browser and the server is encrypted. Nobody on the same coffee shop network can read what you type or alter what you see.

It also means the certificate was issued for the domain in the address bar, by an authority the browser trusts.

For most certificates, the issuer checked only that the applicant controlled the domain, automatically and in seconds. Nobody confirmed who the applicant is, whether their business exists, or whether they are honest.

Chrome's green word Secure beside the padlock describes the connection, not the people at the other end of it.

What it does not prove

• Who runs the site. Most certificates name nobody at all.
• That the business exists, or ever did.
• That the address is the one you meant, rather than a lookalike.
• That the page is safe for a password or a card number.
• That the site has not been hacked and altered.

The third is the one phishing depends on. A fake sign-in page on a lookalike address gets its padlock as easily as the real page does, and looks identical in every other way.

Why free certificates changed the meaning

When certificates cost money and paperwork, many casual scams did without them, and the padlock loosely tracked legitimacy. That link has gone.

A growing number of phishing pages now carry padlocks, and wildcards make it simpler still to cover endless subdomains built to resemble other companies' addresses.

None of this is a criticism of free certificates. Encrypting every site is the right goal, and the same certificates protect a great many small business sites, possibly including yours.

It means the padlock answers a narrower question than most people think.

Reading the address instead

The useful check is the domain: the part of the address between https:// and the next single slash.

Read it from the right. The ending, such as .ca or .com, and the word immediately before it make up the registered domain. Everything further left was chosen by whoever owns that domain.

So an address that begins with your bank's name and ends with something else belongs to the something else. Most fake sign-in pages rely on exactly that.

Watch also for swapped letters, an added word such as secure or support, a different ending, and characters from other alphabets that look like ordinary letters.

On a phone the address bar shows only part of the address, so tap it to see the whole thing before typing anything that matters.

A worked example

A commercial printing company with twelve staff had a simple rule: check for the padlock before signing in to anything.

One afternoon the bookkeeper received an email that appeared to come from a regular customer, saying an invoice had been shared and asking her to sign in to view it.

The sign-in page looked exactly like the company's email provider, with a padlock and the word Secure in green. She checked, as she had been taught, and signed in.

That evening her account sent the same email to everyone in her address book, including dozens of the company's customers.

The company changed her password, turned on two-step verification for every mailbox, and wrote to customers that night asking them not to open the link.

Then it changed the rule. Staff now sign in through bookmarks, read the domain first, and use a password manager, which offers a saved password only on the real domain.

What to teach staff

Replace the padlock rule with a few habits that actually catch fakes.

Sign in to important accounts through a bookmark or by typing the address, never from a link in an email. Before typing a password or card number anywhere, read the domain from the right.

Treat urgency and unexpected requests to sign in as reasons to slow down. Confirm any change to a supplier's payment details by calling a number you already had on file.

Use a password manager. It fills a saved password only on the domain it belongs to, so when it offers nothing on a familiar-looking page, that silence is the warning.

And make it easy to admit a mistake quickly. A password changed within the hour does far less damage than one changed after a week of embarrassment.

What to tell customers

Customers learn what to trust from the emails you send them.

Tell them, on the site and in your emails, what you will never ask for by email: passwords, card numbers, banking details. Tell them your one real domain, and keep the links you send on it where you can.

If you take payments online, use a page on your own domain or your payment processor's recognisable checkout, and say which, so a customer can tell when something is off.

The counter-case

The padlock is not worthless, and your own site still needs one.

On an address you typed or opened from a bookmark, the padlock confirms you are talking privately to that site. It protects what customers type into your forms, and from July Chrome will label any page without it Not secure.

Some sites use extended validation certificates, which show the organisation's verified name beside the padlock in most browsers. That is a stronger signal, though few visitors notice the difference.

Keep your own padlock, then. But teach staff and customers to read the address, not to look for a lock.

This week

1. Retire the padlock rule from staff training.
2. Teach reading the domain from the right.
3. Bookmark the sign-in pages staff use daily.
4. Install a password manager on every work computer.
5. Turn on two-step verification for email.
6. Tell customers what you never ask for.
7. Keep your own certificate renewing automatically.

Step four is the quiet safeguard. People get tired and hurried, and a password manager does not: it offers a saved password only on the domain it was saved for.

Keeping your own certificate current is covered in the 825-day certificate.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.